| Area | Approach |
|---|---|
| Authentication | JWT + refresh tokens; institutional email domain whitelist enforced at signup; OTP verification. |
| Authorization | NestJS guards on all mutating routes; contest actions restricted to the two named participants; admin routes gated by role. |
| Session security | Short-lived access tokens, rotated refresh tokens, revocation on ban. |
| Rate limiting | Applied to all public APIs and to the contest WebSocket gateway's submissionResult event, not just REST endpoints. |
| Secure code execution | Sandboxed, network-isolated Piston containers; backend never runs student code directly. |
| Database security | Parameterized queries via Prisma; least-privilege DB roles; secrets in environment variables, never committed. |
| API security / input validation | class-validator DTOs on all NestJS endpoints; strict schema validation on submission payloads. |
| Anti-abuse | Daily-limit enforcement, flag-based cheating detection, per-user rate limits on challenges and submissions. |
| Audit logs | All admin actions, bans, flag resolutions, and territory transfers are logged with actor, timestamp, and reason. |
Anti-cheating is explicitly treated as defense-in-depth: no single control (paste-blocking, typing model, or diffing) is claimed to be individually sufficient or foolproof.
- Unit tests for the Scoring Service (pure function) against sample easy/medium/hard inputs, including edge cases at the daily-limit boundary.
- Unit tests for the Flag Evaluation Service against synthetic fast-typist data (should not flag) and synthetic paste-bypass data (should flag).
- Integration tests for the full submit → queue → Piston → verdict → score pipeline.
- Load testing with concurrent submissions to validate queue behavior and sandbox isolation under load.
- Sandbox escape / security testing: attempted filesystem/network access, infinite loops, TLE and malicious-input edge cases.
- Concurrency testing for contests: both participants submitting simultaneously, WebSocket disconnect/reconnect within and beyond the grace period.
- Manual auth testing: non-institutional email rejection, OTP flow, token expiry/refresh.
- Basic OWASP Top 10 checklist review before deployment.