Security

HomeWorkr is not ready for real home, stay, or renter evidence until the backend, auth, private storage, backups, and incident process are implemented and tested.

Current Prototype

The current app is a static React PWA prototype with fake demo data. It should not contain browser-side secrets or service-role keys.

Required Production Controls

• Authenticated API access for user records.
• Private object storage for photos, videos, and receipts.
• Short-lived signed upload and download URLs.
• Append-only consent logs before provider sharing.
• Provider links scoped to approved summaries only.
• Backups and restore tests before storing real evidence.

Vulnerability Reporting

Security-report contact details are to be confirmed before launch.