Security

This page describes what the application actually does. It does not make claims that the code cannot back up.

Who can open an invoice

  • The sender. A signed-in account that owns the invoice, or (for guest invoices) the browser that created it, identified by an HttpOnly cookie. The server never accepts ownership claims sent by the browser.
  • A recipient with the link. Links contain a random 256-bit token generated with a cryptographically secure generator. A token only works for the invoice it was created for, can be rotated or revoked by the sender, and does not grant editing rights.
  • Optional password. If the sender adds a password, recipients must enter it through a form (never in the URL). Only a bcrypt hash of the password is stored. Five wrong attempts lock that link for that client for 15 minutes.

What password protection is, and is not

Password protection controls who can open a link. It is not end-to-end encryption: invoice contents are stored in the database and are readable by the service operator and its hosting provider (Cloudflare). If you need confidentiality beyond access control, do not enter that information.

Accounts

  • Passwords are hashed with a modern password hashing function (scrypt) by the authentication library; legacy accounts migrated from an earlier version keep bcrypt hashes.
  • Sessions are cookie based and expire after 7 days of inactivity.
  • Guest drafts are attached to an account only when the same browser that created them signs up or signs in. Matching email addresses are never used to assign ownership.

PDF and email

  • PDFs are rendered by a separate rendering service behind Cloudflare Access. The application authorises the request first, then hands the renderer a single-use, two-minute token that can load exactly one invoice.
  • Email delivery is only enabled when an email provider is configured. When it is not, the application says so rather than pretending an email was sent.

Hosting

The application runs on Cloudflare Pages with a Cloudflare D1 database. No uptime guarantee is offered at this time.

Reporting a problem

Use the contact page. Please do not include invoice contents or passwords in a report.