Security

How access to your workspace and files is managed.

Who can see your work

Your teammates can see the projects in your workspace. Owners and admins manage invitations and gallery links; members add and edit work; viewers can read it. The server checks membership whenever someone requests private workspace data.

Accounts and sessions

Passwords are stored as salted scrypt hashes. Opaque session tokens are stored as hashes in the database and sent in HTTP-only cookies. Sessions expire after seven days. Sign-in and resource-intensive endpoints have request limits.

Files and sharing

Uploaded files are held in a private Cloudflare R2 bucket. File requests check workspace access or a valid, unexpired gallery token. Gallery links reveal only selected files. Revoking a gallery stops further access through its link.

Transport and infrastructure

Production runs on Cloudflare Workers, D1, R2, Queues, and Workers AI. TLS protects traffic to the site. Security headers restrict framing and executable content.

Current limitations

This early access release has no independent security certification, MFA, SSO, or verified-email reset flow. Account recovery uses single-use recovery codes. The browser upload queue stores pending files on the device until they upload or you remove them.