Security Whitepaper
This document explains the technical and organizational measures Only Gantt (the "Service") uses to protect your account and project data. It reflects the controls implemented in the running application.
1. Authentication & Account Security
- Authentication is handled by Google Firebase Authentication; the Service never stores your password.
- Sign in with email/password or your Google account (OAuth 2.0).
- Email/password accounts must verify their email address before accessing project data.
- Sign-up and authentication flows are protected by Google reCAPTCHA Enterprise with score-based risk analysis to block bots and abuse.
2. Session Management
- Sessions use a server-issued
HttpOnly,Secure,SameSite=Laxcookie that is inaccessible to client-side JavaScript. - A session cookie is only minted from a freshly issued ID token (recent sign-in required), so a leaked long-lived token cannot be upgraded into a session.
- Every request re-verifies the token against Firebase and checks for revocation.
- Signing out and account deletion revoke all refresh tokens server-side.
3. Data Isolation & Access Control
- All project data is read and written exclusively through the server using the Firebase Admin SDK.
- Firestore security rules deny all direct client access to project data.
- Every API request is authenticated and scoped to the signed-in user's own account; one user can never read or modify another user's data.
- No third party — including the service operator's clients — can access your project data through the application.
4. Input Validation & Abuse Prevention
- Request bodies are size-limited (2 MB) and rejected if not declared as JSON.
- Per-account limits cap the number of projects and tasks to prevent resource exhaustion.
- Task fields are validated against a strict allowlist, and dangerous keys (
__proto__,prototype,constructor) are blocked to prevent prototype-pollution attacks. - Project identifiers are format-validated before any database access.
- Post-login redirects are restricted to same-site paths to prevent open-redirect attacks.
5. Transport & HTTP Security
- All traffic is served over HTTPS and enforced with HTTP Strict Transport Security (HSTS).
- Clickjacking protection via
X-Frame-Optionsand a Content-Security-Policyframe-ancestorsdirective. - A Content-Security-Policy further restricts
base-uriand disables plugin content (object-src 'none'). - MIME-sniffing is disabled (
X-Content-Type-Options: nosniff); referrer information is minimized; unused browser features (camera, microphone, geolocation) are switched off viaPermissions-Policy. - The framework version-disclosure header is removed, and the UI framework escapes rendered output by default to mitigate cross-site scripting (XSS).
6. Data Storage & Deletion
- Project data is stored in Google Firebase (Firestore), backed by Google Cloud's encryption at rest and in transit.
- Self-service account deletion permanently removes your profile and all project data, and revokes your sessions.
- A server-side backup cleanup process ensures no orphaned data remains if a deletion step is interrupted.
7. Vulnerability Management
- Dependencies are audited for known vulnerabilities and patched on an ongoing basis.
- The application framework is kept current with security releases.
8. Reporting a Vulnerability
If you discover a potential security issue, please contact us through the inquiry channel designated by the Service. We appreciate responsible disclosure and will investigate all reports.