Identity and sessions
First-party authentication uses password hashing, email verification, short access tokens, rotating refresh credentials stored as hashes, SameSite cookies, and CSRF proof for cookie-authenticated mutations.
SECURITY AT INDOO
Protect the brand, the tenant boundary, and every consequential action.
Review Indoo security practices for TLS, headers, identity, sessions, CSRF, rate limits, tenant scope, provider secrets, audit events, deployment, and disclosure.
WHAT MATTERS
The operating details behind the promise.
Tenant and action boundaries
Repository operations apply tenant and brand scope; material writes use authorization, audit context, and idempotency where required.
Edge and operations
The deployment uses TLS, HSTS, compression, restrictive headers, private application networking, health checks, bounded logs, immutable releases, and production configuration validation.
HOW IT WORKS
Move from context to accountable action.
Every stage keeps the brand, goal, evidence, permissions, and work history attached.
- 01
Report privately
Email [email protected] or [email protected] with a concise description, impact, and safe reproduction steps.
- 02
Avoid harm
Do not access other people's data, degrade service, use social engineering, or publicly disclose an unresolved issue.
- 03
Coordinate remediation
Indoo will validate, prioritize, communicate, and request a safe retest when appropriate.
INDOO PRINCIPLE
No SOC 2, ISO 27001, HIPAA, PCI, uptime, data-residency, or other certification claim is made on this page. Request current deployment-specific assurance information.
COMMON QUESTIONS
Direct answers, then the details.
Are sessions stored only in browser local storage?
No. The production design uses short-lived access tokens and rotating server-tracked refresh sessions, with the refresh credential carried in an HttpOnly secure cookie.
How are cross-brand leaks prevented?
Tenant and brand scope are enforced in repository access and integration tokens rather than delegated to an AI model.
Where can I report a vulnerability?
Use [email protected] or the instructions at /.well-known/security.txt.
ONE BRAND BRAIN · ONE LOOP
Put this workflow to work on your real brand.
- No payment card in signup
- Website-first brand setup
- Human approval available