Security
No certification badges we have not earned. This is what is actually implemented, so your security reviewer can check it.
Every row carries a workspace id and every query is filtered by it before it runs. A request naming a workspace you do not belong to is refused at the middleware, and objects inside it return 404 rather than 403 — which avoids confirming they exist.
Short-lived access tokens with refresh rotation: each refresh issues a new token and blacklists the one used, so a stolen refresh token stops working the moment the real device refreshes.
Sign-in, one-time codes and email lookups each have their own budget, so guessing a password or harvesting which addresses have accounts is slow and noisy rather than free.
The app page carries a nonce-based policy with no 'unsafe-inline' in script-src. An injected script cannot guess the per-response nonce, so markup injection cannot become code execution.
HTTPS is enforced in production with HSTS including subdomains and preload, secure and HTTP-only session cookies, and the server refuses to start with a development signing key or a wildcard host.
Attachments are served with a sandboxed policy that strips scripting, so a file uploaded with a misleading name cannot run as a page in someone else's browser.
You can sign in with Google, with Microsoft, or with an email address and a one-time code. Social sign-in verifies the provider's token on our server — against Google's token endpoint, and against Microsoft's public signing keys — rather than trusting anything the browser sends us.
Application data is stored in a PostgreSQL database. Uploaded files are stored on the application's own storage. We do not sell data, we do not use it to train anything, and we do not share it with third parties except the infrastructure providers needed to run the service.
Card details never reach our servers. Payment is handled by a payment provider, and our database holds only a subscription period and a reference issued by that provider. There is nothing card-shaped in it to steal.
Being straight about this is more useful to a reviewer than a page of badges:
If you find a vulnerability, email security@worktaskme.com with enough detail to reproduce it. We will confirm receipt within three working days. Please give us a reasonable window to fix it before publishing, and do not access data that is not yours while testing.