Security & licenses

TASK is built defensively from the database up. Here is exactly what protects your account and your tasks, described honestly rather than in marketing language.

Posture

TASK is a single-tenant PHP application with a MySQL database, served over HTTPS from one domain. The API is same-origin, so there is no cross-site request surface to widen. Every design choice below is in the shipped code, not a roadmap item.

Accounts & passwords

• Passwords are hashed with bcrypt (password_hash / password_verify). The plaintext is never written to disk and cannot be derived from what is stored.
• Rate limiting caps repeated sign-in and registration attempts per email and per IP address, so password guessing is throttled rather than unlimited. The attempt log purges itself.
• Registration can be switched off once the owner's account exists, closing the door to new sign-ups entirely.
• Login responses are deliberately generic ("invalid email or password") so they do not confirm whether an email is registered.

Sessions & requests

• The session cookie is HttpOnly (unreadable by JavaScript, blunting cross-site scripting), Secure (HTTPS only), and SameSite=Lax.
• The session ID is regenerated on login to prevent session fixation, and strict-mode sessions reject unknown IDs.
• Every state-changing request (create, edit, delete, import) must carry a CSRF token tied to your session; requests without a valid token are rejected.
• The UI never builds HTML from your text by string concatenation. Task titles and notes are inserted as plain text nodes, so a task called <script> is shown, not run.

Data handling

• Every database query uses prepared statements with bound parameters. There is no string-built SQL, which removes the classic SQL-injection surface.
• Every task and workspace is scoped to your user ID on read and write, so one account cannot see or touch another's data. Cross-account requests return "not found".
• Server-side validation clamps every field (valid dates, known statuses, importance and urgency within range, length limits) regardless of what the client sends.
• Server configuration and the database schema live in directories that are denied to the web with .htaccess rules, and credentials are kept out of the web root and out of version control.

For the full picture of what is stored and for how long, see the privacy page.

Transport & isolation

• HTTPS is enforced; plain HTTP is redirected.
• Fonts and icons are self-hosted, so no third-party host sees your requests and there is no external script to be compromised.
• The service worker never caches API responses, only static assets, so your task data is not left sitting in a shared cache.

Reporting an issue

Found a security problem? Please report it privately to the operator of this instance rather than opening a public issue, and give a reasonable window to fix it before disclosure. Good-faith reports are welcome and appreciated.

Licenses & attribution

TASK stands on a few pieces of open work, credited here in full:

The MIT and SIL OFL licenses permit commercial use with attribution; that attribution is this table. The TASK application code itself is the work of its author and is not offered under an open-source license unless stated otherwise by the maintainer.

Warranty

TASK is provided as-is, without warranty of any kind. It is a personal-scale tool: keep your own exports if your tasks are important to you. The Export button produces a full JSON backup in one click, and running it now and then is a good habit.