This document explains, at a high level, the security practices Task Box follows. It intentionally avoids describing internal mechanisms, vulnerability locations, or anything that could help someone attack a live deployment.

• Passwords are never stored in plain text; they are hashed with a slow, salted key-derivation function.
• Sign-in is protected against automated guessing through rate limiting and lockouts.
• A one-time, token-gated first-run setup creates the initial owner account.

• Minimum-length and basic strength requirements are enforced on the server.
• Password changes require the current session and invalidate old sessions where appropriate.

• Sessions use signed, time-limited tokens delivered via secure cookies.
• Cookies are marked HttpOnly and Secure with a strict same-site policy.
• Sessions can be revoked centrally so a compromised token can be invalidated.

• Access is role-aware; sensitive administrative areas are restricted to site owners.
• Privileged "break-glass" access is limited, discouraged for routine use, and audit-logged.

• Requests are validated on the server before any processing.
• Client-provided values are treated as untrusted by default.

• User-generated content is escaped on output.
• User-supplied links are sanitized so unsafe URL schemes cannot execute.

• State-changing requests are validated against origin information and fail closed when it is missing or mismatched.

• A strict Content Security Policy and related response headers are sent on every response.
• Transport security (HSTS) and anti-framing protections are enabled.

• Uploads are restricted to a small allowlist of safe image types.
• File contents are checked against their claimed type, not just the file name.
• Uploads are size-limited and rate-limited.

• Errors return generic messages to clients; details are logged server-side only.
• Sensitive values are never included in client-facing responses.

If you believe you have found a security problem, please report it privately and responsibly:

• Open a private security advisory on the GitHub repository, or
• Contact the maintainer through the address listed on the repository profile.

Please do not open public issues for security reports, and please give us reasonable time to investigate and fix before any public disclosure.