Security
How TaskDash and TrueDuty protect time, activity, pay and screenshots, and how to tell us if you find a problem.
Post-quantum channel
The app runs a hybrid handshake (ML-KEM-768 plus two X25519 exchanges) and talks AES-256-GCM on top of TLS. Sequence numbers and timestamps stop replays.
Pinned server key
On first connect the app shows the server key fingerprint and remembers it. A changed key is refused instead of trusted.
Signed offline log
Records written while offline are chained and signed per device. Gaps, edits and reordering are detected and flagged to admins.
Encrypted screenshots
Screenshots are encrypted at rest, uploaded to a random per-person address, and deleted after the retention period.
Least privilege
Roles carry explicit permissions. Nobody can grant more than they hold, and API keys can only read.
Audit trail
Sign-ins, role changes, payouts, policy edits and every screenshot view are written to an audit log.
Accounts
Passwords are never stored in plain text. Sign-in and code attempts are rate limited, and a failed app connection triggers a cooldown.
Network allow lists
Admins can limit app connections to listed IP addresses or ranges.
Session safety
HttpOnly, SameSite cookies, a CSRF token on every change, and a strict Content Security Policy with no inline scripts.
Responsible disclosure
If you find a vulnerability, tell us privately first. We will confirm within three working days, keep you updated, and credit you in the changelog if you want.
- Use the contact page and choose "A security report".
- Include steps to reproduce and what an attacker could do.
- Test only against your own workspace. Do not access other people's data or degrade the service.
For self hosting
- Put the server behind HTTPS (nginx with Let's Encrypt).
- Set TRUST_PROXY only when a proxy sets X-Forwarded-For.
- Back up the database: the server keys live in it, and the app pins them.
- Keep the data folder off the web root; it holds encrypted screenshots.