Security
What is implemented, described specifically enough to be checked.
Password storage
This app stores no passwords at all. Sign-in is handled by our identity provider (Basefyio Auth, a Keycloak realm); your password goes to it over TLS and is never written to our logs, database or error messages.
Sessions
Session cookies hold tokens signed by the identity provider with RS256. Every request verifies the signature against the provider's published keys, pins the algorithm and the issuer, and requires an unexpired token; anything else is treated as no session at all. Cookies are HttpOnly, SameSite=Lax and marked Secure over HTTPS. Your role and plan come from this app's own records, never from the token.
Password reset and email verification
Password reset and email verification use short-lived codes issued and checked by the identity provider and sent to your mailbox. This app never mints its own reset links.
Cross-site request forgery
State-changing form posts are checked against the request Origin. A POST from another site is rejected with a 403 before it reaches any handler.
Authorisation
Every route re-reads the session and re-checks the role server-side. Admin screens are not hidden links — they refuse to render for an account without the role, and their APIs refuse independently of the page.
Webhook handling
Incoming webhooks are signature-verified against the raw request body before the body is parsed, and event ids are de-duplicated so a replayed delivery cannot apply twice. An unverifiable signature is refused; it is never accepted on the assumption that it is probably genuine.
Price integrity
A booking takes its price from the quote it was created from, not from the request that created it. A crafted request cannot set its own price.
Secrets
Signing secrets come from the environment. The app detects the built-in development fallback and warns on the account page when a deployment is still running on it.
What we do not claim
- SOC 2 Type I or Type II — no audit has been performed.
- ISO 27001 — not certified.
- PCI DSS — no card data is handled; payments, when configured, are processed by the provider.
- A published penetration test — none has been commissioned.
If your procurement process requires any of these, say so before you start — we would rather tell you now than after a questionnaire.
Reporting a vulnerability
Send details to security@warehousescanner.co. Include what you did and what you observed. We will confirm receipt, and we will not pursue anyone who reports in good faith and does not access data belonging to other accounts.