Security

Access controls belong in the foundation.

Workspace boundaries

Every project record is scoped to an organization. The server checks current workspace membership for each authenticated request. Owners and admins manage invitations and gallery links; members contribute; viewers read.

Accounts and sessions

Passwords are stored as salted scrypt hashes. Opaque session tokens are stored as hashes in the database and sent in HTTP-only cookies. Sessions expire after seven days. Sign-in and resource-intensive endpoints have request limits.

Files and sharing

Uploaded files are held in a private Cloudflare R2 bucket. File requests check workspace access or a valid, unexpired gallery token. Gallery links reveal only selected files. Revoking a gallery stops further access through its link.

Transport and infrastructure

Production runs on Cloudflare Workers, D1, R2, Queues, and Workers AI. TLS protects traffic to the site. Security headers restrict framing and executable content.

Current limitations

This early access release has no independent security certification, MFA, SSO, or verified-email/password-reset flow. Keep a secure record of your password. The browser upload queue stores pending files on the device until they upload or you remove them.