CareBridger logoCareBridger

Security

Last reviewed: 2026-07-10 · Version: 2026-07-10

CareBridger is a family caregiving product, so we treat the data you bring us as exactly as private as it is. The summaries below describe our posture; the underlying implementation is documented in our Architecture Decision Records.

Authentication and sessions

  • Email + password credentials use PBKDF2-SHA-256 with 100,000 iterations plus a server-side pepper held as a separate secret. Legacy scrypt hashes are verified and transparently re-hashed on next sign-in.
  • Sessions live in HttpOnly, Secure, SameSite cookies backed by a server-side store, with a 24-hour idle and 30-day absolute expiry. WebAuthn (passkeys) is supported as a second factor.
  • Sensitive actions such as account deletion require an explicit, typed confirmation of your account before they proceed.

Storage and transport

  • Public traffic is served over HTTPS through the production ingress. Current TLS-policy verification is an operator-owned release control.
  • The production Node service runs on k3s with PostgreSQL for relational state, Redis for sessions, rate limits and realtime coordination, and S3-compatible object storage for private blobs. Cloudflare Workers, D1, KV, R2 and Durable Objects remain supported non-production and edge runtimes.
  • Backup and integrity-export tooling is maintained in the repository. A current production restore drill is required release evidence and is not inferred from the presence of those scripts.

Tenant isolation

Every account-scoped query goes through the ScopedRepository base, which enforces an account_id filter at the boundary. Inserts assert that the row’s account id matches the repository scope before the SQL is sent.

Vulnerability management

  • Pull-request gates run TypeScript, ESLint, integration tests, production builds, runtime-contract checks, and PII-log scanning.
  • Real-backend Playwright security and role journeys exercise the browser-facing session, CSRF and authorization boundaries.
  • Production dependencies are audited for high and critical findings; RustSec covers the declared non-production Rust surface; gitleaks scans repository history for committed secrets.
  • Security incidents follow the runbook published in docs/runbook.md.

Reporting a vulnerability

Email security@carebridger.com. We acknowledge within one business day. We do not have a bug-bounty programme yet, but we are happy to credit responsible disclosure.