Security
Your rates and your job history are the private numbers of your business. Here is how they are kept, and how to tell us if something looks wrong.
Reporting something
If you think you have found a vulnerability, email [email protected] and put SECURITY in the subject line.
Tell us what you found and how to reproduce it. You will get a reply from a person, usually within two business days. We will not send you a lawyer for reporting a real problem in good faith, and we will tell you when it is fixed.
The machine-readable version of this is at /.well-known/security.txt.
How it is built
Dead Hand is a small web app with a deliberately short list of moving parts. Fewer pieces is itself a security decision.
- Sign-in is passwordless. We email you a link. There is no password to guess, reuse, leak, or for us to store badly.
- Every table is row-level secured. A signed-in account can only ever read and write its own rows. Your rates and your estimates are not reachable from another account, and that is enforced by the database rather than by application code remembering to check.
- Card details never reach us. Payment happens on Stripe's own checkout. We hold a Stripe customer ID and a subscription status, and no card number has ever touched our systems.
- The owner PIN is hashed on your device before it is sent, so the PIN itself never leaves your phone and we could not tell you what it is.
- The app makes no third-party requests. No analytics, no trackers, no advertising, no session recording. Nothing in the app phones anywhere except our own database and Stripe.
- Everything is served over HTTPS with HSTS, a tight Content Security Policy, and the usual frame, sniffing and referrer protections.
What we do not hold
The shortest way to keep something safe is to not have it. Dead Hand holds no card numbers, no bank details, no tax information, no location history, no contacts, no photos, and no customer email addresses. When you send an estimate it goes out through your own mail app, so the recipient's address never reaches us.
What we do hold is set out in full on the privacy page.
The honest part
This is a one-person operation, not a company with a security department. That cuts both ways. There is nobody to hide behind if something goes wrong, and there is also nobody to lose your report in a queue. If something is broken, the person who wrote it will read your email.
We do not run a paid bug bounty. If you find something real, we will fix it, credit you if you want the credit, and say thank you properly.
If something happens
If shop data is ever exposed, we will email everyone affected with what happened, what was in it, and what we did about it — without waiting to be asked, and without the word "unauthorized third party" doing all the work.