Security.

A board holds what a client project is made of: task titles, notes, comments, and the names and addresses of the people at the client. This page sets out the measures in place to protect it.

Encryption in transit

Every connection to Board Badger is over HTTPS, enforced with HSTS. Nothing is sent in the clear.

Passwords

Passwords are hashed with PBKDF2-HMAC-SHA256 and a unique salt per account. They are never stored in plain text and cannot be read by the Operator, so a password cannot be recovered, only reset. Somebody invited to a board has no password at all.

One board, one membership

Every task, comment and membership belongs to one board, and that check runs in the database query itself rather than only in the interface above it. An account cannot read or alter another account's board, a membership of one board grants nothing on another, and the same rule applies to every MCP tool.

Sessions and revoking

Sign-in uses a signed, HttpOnly, Secure session cookie. Changing a password signs that account out of every other device. Revoking somebody's access to a board ends the session already in their browser rather than waiting for it to expire, and their name stays against anything they ticked off. Deleting an account ends the access of everybody invited to its boards and revokes every agent connection at the same moment.

What is actually held

Board names, client names, task titles, notes, states, comments, who did what and when, and the names and email addresses of the client contacts an account holder invites, and files attached to tasks. A file is at most 10 MB, is stored under a random key rather than its name, and is only ever served to somebody on its board after that is checked. Only PNG, JPEG, GIF and WebP pictures, recognised by their contents, open in the browser; every other file downloads and never runs as a page. There are no due dates, because the product has none.

Infrastructure

Board Badger runs entirely on Cloudflare: Workers for compute, D1 for the database, R2 for files attached to tasks, KV for OAuth clients and tokens, and Durable Objects for the MCP connection. There are no servers standing idle to be misconfigured.

Agents and OAuth

An MCP client reaches a board through an OAuth token issued to one account, after a consent screen that account holder had to agree to. A token carries no access to any other account.

Abuse protection

Sign-up and sign-in are rate limited. A Cloudflare Turnstile bot check runs on those pages once it is switched on. Every page is served with a strict set of security headers, including a locked-down Content Security Policy with a per-request nonce.

Reporting a vulnerability

Reports are welcome and are taken seriously. Email security@boardbadger.com, which is also published in security.txt. The Operator will work with a reporter to fix what is found.

An honest note

No online service is perfectly secure. These measures are kept under review, and account holders will be told promptly if anything material happens to their data.