Security
Expense Pools is designed so pool information is available only to authenticated members with an active membership. Security controls are enforced by the API rather than relying only on what the interface hides.
Account protection
- Passwords use adaptive bcrypt hashing and are never stored as readable passwords.
- Web sessions use Secure, HTTP-only, same-site cookies and expire server-side.
- Native sessions use short-lived access credentials and rotating, single-use refresh credentials.
- Raw session, verification, invitation, and recovery tokens are not stored in the database.
- Authentication endpoints are rate-limited and return generic errors where account enumeration is a risk.
Pool privacy
Pending invitations grant no access. A recipient must accept an invitation using the matching verified email. Guest participants have no account credentials and cannot sign in or view a pool.
Operational safeguards
Database changes use tracked migrations, preview rehearsals, read-only maintenance controls, and rollback planning. Sensitive API responses are marked no-store, and authenticated API data is not cached by the service worker.
Report a vulnerability
Send security reports to [email protected]. Include enough detail for Sylvadi Design Inc. to reproduce the issue, but do not send passwords, session tokens, unnecessary personal data, or database exports. Please allow reasonable time to investigate before public disclosure.