# API Security | EternalEngine Security

Every endpoint, hardened. Rate limiting, Zod input validation, parameterized queries, and injection prevention — production-hardened from day one.

Security & Compliance

# Every endpoint, hardened.

EternalEngine's API is protected by multiple defensive layers — rate limiting, strict Zod schema validation, parameterized queries, and injection prevention — stacked so that no single bypass succeeds. Production-hardened from the first commit.

[Start free](https://app.eternalengineos.io/signup?plan=free&interval=annual)[View all security →](https://eternalengineos.io/features/security-compliance/)

API Request Pipeline

POST /api/contacts

{ "name": "...", "email": "..." }

1

Rate Limiter

100 req/min per IP · sliding window · 429 on breach

✓ pass

2

JWT Verification

RS256 signature · expiry · tenant_id extracted

✓ pass

3

Zod Schema Validation

Type check · max lengths · format rules · strip unknowns

✓ pass

4

Parameterized Query

INSERT INTO contacts ... WHERE tenant_id = $1

✓ safe

✓ Request processed — 201 Created · zero injection surface

## Defense in depth — every layer counts

Security isn't one mechanism. It's multiple overlapping controls so that no single bypass leads to a breach.

### Rate Limiting

Per-IP sliding window rate limits protect every endpoint from brute force, scraping, and denial-of-service abuse. Burst allowances accommodate legitimate traffic spikes without impacting genuine users.

### Zod Input Validation

Every API request body is parsed against a strict Zod schema. Unknown fields are stripped. Type coercions are rejected. Malformed payloads return 400 before any business logic runs — no data ever reaches the database unchecked.

### Parameterized Queries

Every database query uses parameterized statements — never string interpolation. User-supplied values are always treated as data, never as SQL. SQL injection is structurally impossible, not just tested against.

### Injection Prevention

Beyond SQL — XSS vectors are stripped at input, command injection is prevented by avoiding shell execution entirely, and path traversal is blocked by strict file access controls. The entire OWASP Top 10 injection surface is addressed.

## Hardened for production from day one

You shouldn't have to configure your way to secure. EternalEngine ships with production-grade defenses on by default.

### Zero Injection Vectors

Parameterized queries + Zod validation means user input can never become code. SQL injection, NoSQL injection, and XSS are structurally prevented — not just mitigated.

### Abuse Protection

Rate limiting stops automated abuse before it affects your data or performance. Brute-force attacks, credential stuffing, and scraping bots hit a wall before they reach your business logic.

### Production-Hardened

Every defensive layer was designed by engineers who've operated at scale. Not security added after launch — security baked into every architectural decision from the first line of code.

Zod

Schema validation on every input boundary

pg

Parameterized queries, never string concat

RS256

Asymmetric JWT signing, tamper-proof

RLS

Database-enforced tenant isolation

Questions

## Common questions, straight answers.

### Keep exploring

- [All security features](https://eternalengineos.io/features/security-compliance/)
- [JWT authentication](https://eternalengineos.io/features/security-compliance/jwt-authentication/)
- [Tenant isolation](https://eternalengineos.io/features/security-compliance/tenant-isolation/)
- [Plans and pricingFree to start; every paid plan has a 30-day free trial.](https://eternalengineos.io/pricing/)

How are requests validated?

Every request body is parsed against a strict schema; unknown fields are stripped and malformed payloads are rejected before any business logic runs.

How is SQL injection prevented?

Every database query uses parameterized statements, so user input is always treated as data, never as SQL.

Is there rate limiting?

Yes. Per-client limits protect every endpoint from brute force and scraping and return 429 when exceeded.

Can I use the API myself?

Yes. API access and webhooks are included on Pro and Business.

## Run your business from one place.

Five plans, seventeen launch apps, one dashboard. Set up in under 5 minutes — change tiers any time.

[Start free$0 forever • No card • Upgrade any time](https://app.eternalengineos.io/signup?plan=free&interval=annual)[Talk to Sales](https://eternalengineos.io/contact/)

From $0 · Basic $9.95/mo · Save 20% on annual billing · Upgrade or downgrade any time