Security

Last updated 16 August 2026

Keeping households apart

Every request is resolved to a household on the server, from a signed session — never from anything the browser claims. Every database query is filtered by that household. Guessing another household's record id returns "not found", not their data.

This is the single most important property of the system, so it is covered by an automated suite that attempts cross-household reads and writes across every endpoint. It runs against production, not just a laptop.

Passwords

Passwords are hashed with PBKDF2-SHA256, a random per-account salt, and a secret pepper held in the server environment and never in the database. A stolen copy of the database is not enough to attack them. Each hash records its own cost factor so it can be strengthened later without locking anyone out.

Sessions

Sessions are HMAC-signed tokens in HttpOnly, Secure, SameSite=Lax cookies. A tampered or expired token is rejected outright. Signing out clears it.

Wall displays

A wall display never holds your password. Pairing issues it a separate random credential, of which only a hash is stored, and that credential is deliberately limited: a display can show the household and tick off chores and list items, but cannot touch billing, family members or security settings. Revoking it from your phone takes effect immediately.

Payments

Card details never reach Lodestead. Checkout and card management happen on Stripe's own pages. Subscription changes are accepted only from Stripe webhooks whose signature we verify, and each event is processed exactly once.

Abuse

Sign-in, sign-up and device pairing are rate limited per address and per account. Requests are validated on the server; nothing trusts the client.

Transport and headers

Everything is served over HTTPS with HSTS. A content security policy restricts what the page may load and where it may send data, framing is denied, and MIME sniffing is off.

Reporting a problem

If you find a security issue, email [email protected]. Tell us what you found and how to reproduce it, and please give us a reasonable chance to fix it before publishing. We will not pursue anyone who reports a genuine issue in good faith.