Security

Sessions are issued as signed, httpOnly cookies and validated on the server for every request to a protected route. Access control is never based on values stored in the browser alone.

Role-based access control is enforced server-side. Sensitive areas such as the administrator console are restricted to accounts with the appropriate role, verified on each request.

Task funds are held in escrow and released only on completion, reducing risk for both clients and agents.

If you believe you have found a security issue, please contact us through our contact page. We appreciate responsible disclosure and will respond promptly.