Security approach
HeavyFeather uses layered controls appropriate to an actively developed web application. Security is treated as ongoing engineering work, not as a certification claim. This page describes controls currently implemented and does not claim that any system is risk-free.
Hosting and transport
- The production application is hosted on Cloudflare and served over HTTPS.
- HTTP Strict Transport Security instructs compatible browsers to use encrypted connections for the domain and its subdomains.
- Production data is stored in a tenant-scoped Cloudflare D1 database.
Accounts and access
- Passwords are stored as one-way hashes rather than recoverable plaintext.
- New accounts currently require manual early-access review before they can enter a workspace.
- Application routes enforce account, workspace, and staff authorization boundaries.
- Sessions use secure cookie-based authentication controls.
Connected-service credentials
Provider credentials, OAuth refresh tokens, and integration secrets are encrypted at rest with AES-256-GCM, masked by default in the interface, and used on the server. HeavyFeather requests provider permissions that support visible product features and documents the current Google Ads data scope in the Privacy Policy.
Browser and application protections
HeavyFeather sends security headers that restrict embedding, object content, form destinations, referrer disclosure, sensitive browser capabilities, and MIME-type interpretation. Policies are kept compatible with the application's legitimate Shopify and Google authorization workflows.
Analytics and public forms
Google Analytics is consent-gated and limited to public pages. It does not load in private customer or staff workspaces. Public contact and signup endpoints use validation and abuse controls, and submitted messages are reviewed in the private staff interface.
Report a security concern
If you believe you found a security or privacy issue, use the Contact form and begin the subject with “Security report.” Include the affected URL, the behavior you observed, and a safe way to reproduce it. Do not access another person's data, disrupt the service, or perform destructive testing. HeavyFeather does not currently operate a public bug-bounty program or claim a formal security certification.