Security

Accounts and sessions

• Passwords are hashed with Argon2id. We never store or log the password itself.
• Sign-in uses equal-time checks so the login form doesn't reveal which emails have accounts, and sign-in attempts are rate-limited.
• Sessions are server-side and revocable: the HttpOnly session cookie only names a session record that is checked on every request, so logging out, password changes and removal from a household take effect immediately.

Household isolation

• Every operation is authorized on the server against your household membership and role (owner or editor).
• As defense in depth, Postgres row-level security restricts every household-owned table to the current household. The application connects as a non-owner database role, so these policies apply to it and cannot be bypassed by application code.
• Platform operators do not have default access to private household content.

Correct stock records

• Inventory changes are recorded in an append-only ledger. Balances cannot go negative; discrepancies require a correction with a reason.
• Confirming a purchase and marking a meal cooked are idempotent: a retried or double-tapped request is applied exactly once.
• Undo creates a single compensating entry rather than erasing history.

Uploads and AI

• Uploaded images are type- and size-checked, decoded, re-encoded (stripping metadata) and stored privately.
• Recipe text and photos are treated as untrusted data. The AI import has no tools, no secrets and no access to household data; its output is schema-validated and saved only as a draft for a person to review.

Operations

• Secrets are kept server-side and out of source control.
• Billing entitlements change only from verified, de-duplicated provider events.
• Private content is kept out of application logs.
• Backups are taken regularly and restore procedures are tested.

Responsible disclosure

If you believe you have found a vulnerability, email [email protected] with steps to reproduce. Please don't access other households' data, degrade the Service, or publicly disclose the issue before we have had a reasonable time to fix it. We will acknowledge reports, keep you informed, and will not pursue legal action against good-faith research that follows these guidelines.