BoardRepo electronics project sharing

Security

How BoardRepo protects private boards and files, and how to report a security issue.

Last reviewed: August 24, 2026

Summary

  • Private files are stored in private object storage, and each download request is authorized.
  • Uploaded archives are untrusted input and conversion runs inside fixed limits.
  • The database stores credential hashes rather than usable session or connection tokens.
  • The Content Security Policy is report-only today, not enforced.
  • SOC 2 and ISO 27001 work is underway.

Security approach

This page describes how private links work, where files are stored, and which safeguards are currently in place.

We are working toward SOC 2 and ISO 27001. We will share updates here as that work progresses.

A private-link project is unlisted and marked noindex. Anyone with its URL can open the project, including when somebody forwards it. Add a password when the link alone should not provide access.

After the link or password check, BoardRepo sets a scoped, httpOnly cookie. The project page and its files are authorized separately. A browser that may view the page does not get a blanket pass around download checks.

File storage and downloads

Originals and generated output are in private object storage. BoardRepo authorizes each download request. Large files are then delivered with a signed URL that expires in roughly ten minutes, and the redirect is marked not to be cached by the browser.

Upload processing

Before BoardRepo extracts an upload, it checks for unsafe archive patterns:

  • paths that try to leave the working directory;
  • duplicate or conflicting names;
  • symlinks and special files; and
  • too many files or too much expanded data.

Conversion runs as a non-root process with memory and time limits. Nested archives are not extracted recursively. Generated output has its own size cap.

Accounts and tokens

BoardRepo keeps hashes instead of usable session, email sign-in, API, and OAuth tokens. Cookies that carry sessions, access grants, and OAuth state are httpOnly, Secure in production, and SameSite. Google and GitHub sign-in are also available. A connected assistant gets an expiring token for the scope you approved, and you can revoke the connection in Settings.

Browser security controls

HTTPS and HSTS are enforced in production. Other headers limit framing, content sniffing, referrer details, and browser permissions. The Content Security Policy is currently report-only. It does not block scripts, and BoardRepo does not yet collect violation reports through a CSP reporting endpoint.

Backups and monitoring

The app and database run on AWS behind Cloudflare. Project files and off-host database backups are in Cloudflare R2. We keep nightly dumps, incremental backups, and a continuous write-ahead-log archive. An hourly check alerts us if that archive stops receiving entries. Sentry and PostHog help us monitor application errors and product behavior.

What you can do

We cannot stop a recipient from forwarding a private link or keeping a file they already downloaded. Keep your sign-in account safe, revoke old assistant connections, and check visibility before publishing. Keep a local backup of important boards.

Report a security issue

Email [email protected]with the affected URL, reproduction steps, and likely impact. Use your own accounts and boards. Stop if you see another person's private data, and do not put secrets or board files in the opening email.

We do not currently offer a public bug bounty. Please allow reasonable time for us to investigate and address a report before publishing it. The machine-readable contact is /.well-known/security.txt.

Questions

For personal-data questions, use [email protected] or read the Privacy Policy.