Security

Last updated 31 October 2026

Keeping households apart

Every request is resolved to a household on the server, from a signed session — never from anything the browser claims. Every database query is filtered by that household. Guessing another household's record id returns "not found", not their data.

This is the single most important property of the system, so it is covered by an automated suite that attempts cross-household reads and writes across every endpoint. It runs against production, not just a laptop.

Passwords

Passwords are hashed with PBKDF2-SHA256, a random per-account salt, and a secret pepper held in the server environment and never in the database. A stolen copy of the database is not enough to attack them. Each hash records its own cost factor so it can be strengthened later without locking anyone out.

Sessions

Sessions are HMAC-signed tokens in HttpOnly, Secure, SameSite=Lax cookies. A tampered or expired token is rejected outright. Signing out clears it.

Wall displays

A wall display never holds your password. Pairing issues it a separate random credential, of which only a hash is stored, and that credential is deliberately limited: a display can show the household and tick off chores and list items, but cannot add or change entries, family members or settings. Revoking it from your phone takes effect immediately.

Abuse

Sign-in, sign-up and device pairing are rate limited per address and per account. Requests are validated on the server; nothing trusts the client.

Transport and headers

Everything is served over HTTPS with HSTS. A content security policy restricts what the page may load and where it may send data, framing is denied, and MIME sniffing is off.

Reporting a problem

If you find a security issue, email hello@lodestead.com. Tell us what you found and how to reproduce it, and please give us a reasonable chance to fix it before publishing. We will not pursue anyone who reports a genuine issue in good faith.