Security

Two separate keys, so the link you share can never manage the list.

How it works

• Two unrelated links. Share and owner tokens come from a cryptographic random source (96 and 256 bits). One cannot be derived from the other, and no list id is ever used as a key.
• Owner link stored as a hash. The server keeps only a SHA-256 hash, so a database leak does not reveal working owner links. The owner link is never put in a QR code or share text and is never sent in a Referer header.
• Permissions enforced on the server. View, update and edit are checked on every request; hiding a button is never the only protection. Locked and completed lists are read-only for participants.
• Passwords and codes. Optional list passwords and login codes are hashed, guessing is rate limited and every wrong guess gets the same message.
• CSRF and XSS. Every change carries a per-session token. Content is never inserted as HTML, and a strict Content Security Policy blocks inline scripts and third-party hosts.
• Safe links and exports. Only http and https links are accepted. CSV exports neutralise spreadsheet formulas.
• Rate limiting. Creating lists, changes, votes, owner-link guesses and logins are limited per client.
• No third parties. No analytics, no external fonts or scripts. QR codes are generated in your browser.

Limits you should know

• Anyone with the share link gets the permission you chose. Participants are anonymous, so names are self-declared and duplicate-vote protection works per browser, not per person.
• Anyone with the owner link can manage the list, so keep it private. Without an account there is no recovery if it is lost.
• Accounts use one-time email codes (TAC): codes expire in 10 minutes, work once, allow 5 wrong tries and are rate limited. Anyone who controls your Gmail inbox can log in, so protect it with 2-step verification. Only Gmail addresses are accepted for now.

Found a problem? Please tell the Bidadari team before sharing it publicly. See also Privacy.