Security

Passwords are hashed with Argon2id and nothing else. We cannot read yours, and neither can anyone with a copy of the database.

NextMUN will never set, email, transport or display a password. An account opened by an administrator gets an unusable random hash plus a single-use setup link, so there is no default password to guess.

Session tokens, password reset tokens, Executive Board invitations and six-digit email codes are stored only as SHA-256 hashes. The plain value exists in your browser or your inbox and nowhere else.

Email codes carry a guessing budget: six digits is only a million combinations, so a row is burned after a handful of wrong tries rather than left open to a grind.

An organiser's Moyasar secret key cannot be hashed, because it is sent back to Moyasar on every charge. It is encrypted with AES-256-GCM under a key held in the server environment and never in the database.

Saved autofill answers, such as your legal name, phone number and emergency contact, cannot be hashed either, because they are poured back into application forms. They are encrypted with AES-256-GCM under a separate key, also held only in the server environment, so a copy of the database on its own does not reveal them.

It is never rendered back to a browser. The settings page shows only the last four characters so a team can tell which key is connected.

We never see them. Payment details go from your browser directly to Moyasar, which is PCI compliant. NextMUN stores a payment reference, an amount, a status, and at most a card brand and last four digits.

Sessions live server side and can be revoked. Every server action re-checks authorisation itself rather than trusting the page that called it, because an action is reachable by POST without going near the interface.

Permissions on a conference are granular and checked per action and per application type, so somebody who can read chair applications cannot decide on delegate ones.

If you find a vulnerability, write to saadalarifi@nextmun.org with enough detail to reproduce it. Please do not test against other people's accounts, conferences or payments. We will confirm we have it and tell you when it is fixed.