Security at FieldForge

Honest summary for a pilot-stage product · Last updated 2026-06-12

Contractors trust us with blueprints, jobsite locations, and project details. No software is "completely secure", so instead of promises we list what we actually do:

• Projects are private by default; nothing you upload is publicly listed or indexed.
• Uploads are restricted to PDF/PNG/JPEG/WebP, size-limited, validated by file contents (not just declared type), stored under random names outside the web root, and served only through controlled routes. Uploaded files are never executed.
• Crew share links use long random tokens, are excluded from search indexing, and can be revoked.
• All inputs are validated server-side; user text is escaped on render.
• Abuse-prone endpoints are rate-limited; lead forms carry anti-bot protections.
• Browser security headers (CSP, frame denial, content-type protections) are enforced.
• Secrets are kept out of the codebase; dependencies are audited.
• We collect the minimum data needed and run no ad tracking (see Privacy).

Reporting a vulnerability

Email klau0350@gmail.com with details. We appreciate responsible disclosure and will respond as fast as a small team can — typically within a few business days.