Security

Security overview

Quickcheck is built with security as a core requirement. All data is encrypted in transit and at rest. Authentication is handled by Supabase Auth, and database access is restricted by row-level security policies.

Authentication

Authentication is handled by Supabase Auth, which provides secure session management using JWT tokens with automatic refresh. Passwords are hashed using bcrypt and are never stored in plain text.

We support three authentication methods:

• Email and password — accounts are protected by password hashing and optional email confirmation.
• Google Sign-In — authentication is delegated to Google using OAuth 2.0. We never receive or store your Google password.
• GitHub Sign-In — authentication is delegated to GitHub using OAuth 2.0. We never receive or store your GitHub password.

Data storage

All data transmitted between your browser and Quickcheck's infrastructure is encrypted using HTTPS/TLS. This includes checklist content, authentication credentials, and API requests. Insecure HTTP requests are automatically redirected to HTTPS.

Checklist data is stored in PostgreSQL databases with row-level security (RLS) policies. Each user's data is isolated at the database level, ensuring that users can only access their own checklists. Database backups are encrypted and stored securely.

Infrastructure

Quickcheck is built on Supabase, a hosted backend platform that provides authentication, database, and storage services. Supabase runs on AWS infrastructure and maintains industry-standard security certifications.

Your data is stored in PostgreSQL databases with automated backups, encryption at rest, and network isolation. Database connections are encrypted using TLS. Access to production infrastructure is restricted to the core development team and requires multi-factor authentication.

Responsible disclosure

If you discover a security vulnerability in Quickcheck, please report it privately to roshanmallick2025@gmail.com.

We ask that you:

• Do not publicly disclose the vulnerability before we have had an opportunity to address it.
• Do not exploit the vulnerability beyond what is necessary to demonstrate it.
• Do not access or modify another user's data without their explicit permission.

We will acknowledge receipt of your report within 72 hours and work to address verified vulnerabilities promptly.