Protecting accounts
- All traffic is encrypted in transit (HTTPS).
- Passwords are stored hashed, never in plain text.
- Sign-in attempts and codes are rate-limited.
- Password resets log out other devices.
Protecting the counter
- Rotating card codes: a customer's card QR changes every 30 seconds, lives 60 seconds and works once. Screenshots don't work.
- Server-side earning: points, stamps and cashback are calculated on our server from the business's rules. Balances sent from a phone are never trusted.
- One reward per scan, with balance checks enforced by the database.
- Own-card block: staff can't earn on their own card at their own business.
- Typed lookups can't spend: finding a customer without their phone records earnings only; rewards need the customer's QR.
Protecting businesses
- Every staff member has their own login, with roles and custom permissions.
- Important changes can require approval from other owners.
- An append-only audit log records every change and counter action.
Infrastructure
Hosted with established providers (Neon for the database, Railway for servers, Cloudflare for websites and images). Data at rest is encrypted by our database provider. Production credentials are kept out of code.
Reporting a vulnerability
Found a security issue? Email [email protected] with "Security" in the subject and the steps to reproduce it. Please don't access other people's data or disrupt the service while testing. We'll reply, keep you updated and credit you if you'd like.