Security
Expense Pools is designed so pool information is available only to authenticated members with an active membership. Security controls are enforced by the API rather than relying only on what the interface hides.
Account protection
- Passwords use adaptive bcrypt hashing and are never stored as readable passwords.
- Web sessions use Secure, HTTP-only, same-site cookies and expire server-side.
- Native sessions use short-lived access credentials and rotating, single-use refresh credentials.
- Session, verification, invitation, refresh, and recovery credentials are stored as one-way hashes when server-side lookup is required; raw credentials are not retained in those database fields.
- Passkeys use public-key credentials. Private keys remain under the control of the user’s device or credential provider.
- Face ID and Touch ID are optional local unlock mechanisms. Expense Pools does not receive or store biometric templates.
- Authentication endpoints are rate-limited and return generic errors where account enumeration is a risk.
Pool privacy
Pending invitations grant no access. A recipient must accept an invitation using the matching verified email. Guest participants have no account credentials and cannot sign in or view a pool.
Operational safeguards
Database changes use tracked migrations, preview rehearsals, read-only maintenance controls, and rollback planning. Sensitive API responses are marked no-store, and authenticated API data is not cached by the service worker.
Report a vulnerability
Send security reports to help@sylvadi.com. Include enough detail for Sylvadi Design Inc. to reproduce the issue, but do not send passwords, session tokens, unnecessary personal data, or database exports. Please allow reasonable time to investigate before public disclosure.