Account and access controls
Passwords are hashed with bcrypt; sessions use HTTP-only cookies and server-side token digests. Document and audio APIs check account ownership. Password-reset links are single use and a completed reset revokes previous sessions. Administrative actions require authorization, and sensitive integration changes require a password check.
Storage and service credentials
Originals and audio use private R2 storage with short-lived signed URLs. Provider secrets are encrypted in the database. A bearer download link may remain usable until it expires; content already downloaded to a device cannot be recalled. This is not end-to-end encryption: authorized services need to process text and speech.
Current boundaries
The product has not completed a public production security audit. Administrator MFA, full incident monitoring, production backup restoration drills and wider abuse controls remain work before public beta. No certification or uptime guarantee is claimed here.
Report a vulnerability
Send a LeafRead security report to support@leafread.io with a short description and minimal reproduction steps. Avoid accessing other people’s data or disrupting the service. Do not include passwords, active tokens or full private documents. No public bug-bounty payment program is offered.