ScopeGuard Pro
TRUST

Security & Safety

How ScopeGuard Pro protects project records and client approval flows.

This page describes application-level protections currently used by ScopeGuard Pro. It is not a formal third-party security audit and does not describe every hosting or infrastructure control.

Account access

  • The dashboard and project workspace require account login.
  • Passwords are stored as hashes, not plaintext.
  • Session cookies are HttpOnly, HMAC-signed, SameSite=Lax, and Secure in production.

Account-scoped project data

Projects, client requests, Change Orders, uploaded contracts, inbox attachments, and Evidence Pack downloads are scoped to the owning account. Evidence Pack download requires login and project ownership.

Client approval links

  • Client approval links use unguessable token URLs.
  • Clients can approve or decline without creating an account.
  • Approval links can be revoked by the project owner while active.
  • Links are locked after approval or decline when the workflow closes the decision.

CSRF and authentication abuse controls

  • CSRF protection is applied to high-risk authenticated POST routes and forms.
  • Login and registration have rate limiting (currently 5 attempts per 15 minutes per IP, and per email for login).
  • Rate limiting is in-memory and resets when the application process restarts.

Webhooks and payments

  • Lemon Squeezy payment webhooks are signature-validated. Duplicate events are handled idempotently.
  • Inbound email webhooks require a secret header value.

Public pages and previews

  • The sample Change Order page uses demo screenshots and does not expose private customer data.
  • Internal homepage preview routes are disabled by default unless explicitly enabled for local development.
  • The public /health endpoint returns only a minimal status payload.

Secrets and repository hygiene

Environment secrets such as API keys and webhook secrets are intended to be kept out of the repository through .gitignore and deployment configuration.

Third-party processing

Some protections are application-level only. AI providers, analytics, email, payment, and hosting providers may process data as described in the Privacy Policy. ScopeGuard Pro does not claim encryption at rest, GDPR compliance, or EU hosting on this page.

Report a concern

Security or abuse concerns: hello@scopeguardpro.com