Security

Your account

Your password is stored as a bcrypt hash, so we cannot read it back. A password has to be at least 12 characters.

You can add a second step at sign-in, either an authenticator app or a code by email. The authenticator secret is encrypted with AES-256-GCM. An emailed code, and the one-time recovery codes, are stored only as hashes. We show the recovery codes once. Turning the second step on signs your other devices out.

Your security settings list the devices you are signed in on, and you can log one out. A session ends within 60 days. We do not store your IP address with it.

You can also sign in with Google, and you can always use your email and password instead. We do not ask Google for your contacts or your calendar.

Sign-up, log-in, password reset, a request to join a pool, and the community form on the Garden map and list each run a bot check before they continue. The check is Cloudflare Turnstile.

If you create a token so a program can act as you, we store a hash of the token and show it to you once. You can revoke it from your app settings.

You can download a copy of your data from Privacy settings, or delete your account from your profile settings. Deleting it removes your account and the listings you posted. A review does not show the author's name. We also keep what accounting and tax law require.

Your photos

Tigris stores the photos you upload as private objects. The app shows a photo through a short-lived link.

Before anyone can see a photo, we strip the camera data, including the GPS location. The original file is held privately while it is processed, then deleted, and it is never shown. A photo on a tool, a skill, or a request is shown through a link built from that listing, so the address does not say whose photo it is.

Who can see what

A tool, a supply, or a skill does not name you on its pool page or its listing page. You decide whether to Reveal yourself in the chat for it. A request names the person who posted it to the members of the pools it is in. The person who responds stays unnamed until they decide to Reveal.

A private pool opens for its members. A listing that is only in private pools checks that you are a member.

Read the Privacy Policy for what we collect, the other companies that receive it, and how long we keep it.

Where the service runs

Fly.io hosts the application and the database. The database runs on Fly.io's private network and is not reachable from the public internet. The site is served over HTTPS, so data in transit is encrypted with TLS. Secrets stay in the hosting secret store rather than in the repository.

How a change ships

Adversarial review agents read each change to what the app does before it ships. One agent looks for an input that makes the change wrong, and another checks the change against the written description of that feature. When a person would read the change or use it, another agent checks that it works from the keyboard and that colour is not the only signal. When the change is about who can see a person, or who can do something, an agent asks who can now see it or do it. A screenshot is opened by its own agent, which tries to reject the picture before we keep it.

Before a production release, the pipeline runs the application's test suite. The same stage runs static application security testing (SAST). The scan reads the application source for security problems.

The same stage checks the Elixir lockfile with Hex and the JavaScript lockfile with npm. The check fails when either one finds a published vulnerability.

A new release has to pass a health check that reaches the database before it replaces the rest of the running machines.

Policies we follow

We keep written internal policies for information security, incidents, access, backups, and vendors.

• Information security. People only get access for the work they're doing.
• Incidents. Before a finished diagnosis, we revoke or rotate compromised credentials, disable affected accounts, take the affected part offline, or block an access path. We tell people in the United States under the breach-notification law of the state they live in, without unreasonable delay, and when we are the processor we tell the organization we process data for.
• Access. Staff tools that act across the whole platform are limited to the people who need them. We keep an audit log of what those people do.
• Backups. Fly.io keeps automatic backups of the database, and a restore builds a new database from a backup or from a point in time while the live one stays up. We do yearly production backup restoration tests in addition to the Fly.io point in time backups that can happen at any time. Restoring photos makes a new Tigris bucket from a snapshot.
• Vendors. A written policy covers how we choose and watch the companies that store or process personal data. The public list of those companies is in the Privacy Policy.

Reporting a vulnerability

If you want to look for security problems in ToolPool.Garden, read section 8 of the Acceptable Use Policy first.

Email us at [email protected] with what you want to test and how. Wait for written permission before you start.

When you find something, send enough detail for us to reproduce it, and give us a chance to fix it before you tell anyone else.