Security.

A board holds what a client project is made of: task titles, notes, comments, and the names and addresses of the people at the client. This page sets out the measures in place to protect it.

Encryption in transit

Every connection to Board Badger is over HTTPS, enforced with HSTS. Nothing is sent in the clear.

Passwords

Passwords are hashed with PBKDF2-HMAC-SHA256 and a unique salt per account. They are never stored in plain text and cannot be read by the Operator, so a password cannot be recovered, only reset. Somebody invited to a board has no password at all.

One board, one membership

Every task, comment and membership belongs to one board, and that check runs in the database query itself rather than only in the interface above it. An account cannot read or alter another account's board, a membership of one board grants nothing on another, and the same rule applies to every MCP tool.

Sessions and revoking

Sign-in uses a signed, HttpOnly, Secure session cookie. Changing a password signs that account out of every other device. Revoking somebody's access to a board ends the session already in their browser rather than waiting for it to expire, and their name stays against anything they ticked off.

What is actually held

Board names, client names, task titles, notes, states, comments, who did what and when, and the names and email addresses of the client contacts an account holder invites. There is nowhere in Board Badger to upload a file, so no document ever sits here. There are no due dates, because the product has none.

Infrastructure

Board Badger runs entirely on Cloudflare: Workers for compute, D1 for the database, KV for OAuth clients and tokens, and Durable Objects for the MCP connection. There are no servers standing idle to be misconfigured.

Agents and OAuth

An MCP client reaches a board through an OAuth token issued to one account, after a consent screen that account holder had to agree to. A token carries no access to any other account.

Abuse protection

Sign-up and sign-in are rate limited. A Cloudflare Turnstile bot check runs on those pages once it is switched on. Every page is served with a strict set of security headers, including a locked-down Content Security Policy with a per-request nonce.

Reporting a vulnerability

Reports are welcome and are taken seriously. Email security@boardbadger.com, which is also published in security.txt. The Operator will work with a reporter to fix what is found.

An honest note

No online service is perfectly secure. These measures are kept under review, and account holders will be told promptly if anything material happens to their data.