Security

Built to limit what an incident can expose.

Current controls

• Free projects and photos remain on the customer's device by default.
• No shared or emailed account password; paid access uses revocable project codes/magic links.
• Secrets stay in Cloudflare bindings, not source code or browser JavaScript.
• API payload limits, input validation, same-origin policy, security headers, and bot traps reduce abuse.
• Stripe webhook signatures-not browser redirects-control paid access.
• Access codes are hashed server-side when storage is enabled.

Identity data

Verified-pro identity should use a specialist provider. Raw government-ID images should not be copied into normal project storage.

Report a problem

Email security@icanhandyman.app with the affected URL, steps to reproduce, impact, and a safe way to contact you. Do not access other users' data or disrupt service while testing.

Status

The health endpoint reports which optional systems are connected without revealing secret values: /api/health.