Security

The controls below are live in the product today.

Encryption

• In transit: TLS everywhere (Cloudflare edge + origin certificates); HTTP is redirected to HTTPS at the edge.
• At rest: task content is encrypted with AES-256-GCM under a per-user data key, which is itself wrapped by the application master key (envelope encryption). OAuth tokens and share snapshots are encrypted the same way.
• Crypto-shredding: account deletion destroys the user's wrapped key inside the deletion transaction. Backups roll off within 14 days, after which no copy can be decrypted.

Application controls

• Session-cookie authentication with CSRF protection; password hashing via bcrypt; password resets invalidate all other sessions.
• Rate limiting on authentication, password, sharing, and billing endpoints.
• Strict security headers: CSP with no third-party scripts, frame-ancestors none, nosniff, referrer and permissions policies.
• Authenticated API responses are never cacheable; share links are 256-bit capability URLs, revocable and expirable.
• An append-only security event trail (logins, credential changes, exports, shares) that each user can inspect in Settings.

Operations

• Continuous encrypted backups to off-site object storage.
• Dependencies pinned by lockfiles; deploys are atomic with instant rollback.
• Anonymous traffic is served from the CDN edge without touching the application or database.

Reporting a vulnerability

Email [email protected]. We commit to acknowledging reports within 72 hours and will credit you (if you wish) once fixed. Please avoid testing against accounts you don't own.