Security & Privacy
All of PaceStreak is open source
The app, the API, both sites and the infrastructure notes are now public on GitHub under AGPL-3.0. What that took, and what was checked first.
2 min
security
9 posts.
Security & PrivacyNotification buttons without a session
A habit reminder now has Done and Snooze buttons. The service worker that handles them has no access token, by design, so each button carries a signed, single-purpose link instead.
2 min
Security & PrivacyScanning barcodes without the camera permission
The app's Permissions-Policy says camera=(). Barcode scanning shipped anyway, by reading a photo instead of a video stream, and the lookup sends the barcode and nothing else.
1 min
Security & PrivacyFixing the dead ends in sign-up and verification
Three real bugs found by using the OTP flow the way a person actually would: a stuck login, a false 'already registered' error, and a confirmation screen that didn't lead anywhere. Plus a status page that finally watches the whole stack.
3 min
Security & PrivacyThe API is live, and deploys itself
The API's hosting decision is made: a free-tier GCP VM, Neon and Upstash, zero-downtime rolling updates on a single-node Swarm - and why the VM pulls its own updates instead of GitHub Actions pushing them.
5 min
Security & PrivacyCloudflare Turnstile guards the mailer, not the login screen
Turnstile went on signup, login, forgot-password, resend-verification and recover for one reason: those five endpoints can empty a free email quota or grind past a rate limit, and a CAPTCHA on the feed or the streak grid would only annoy people who never touch them.
2 min
Security & PrivacyWhen the streak should wait: pauses, planned rest and importing from a watch
Five features built in one pass: an injury pause that can't be abused, planned rest on the grid, a weekly recap, GPX/FIT/CSV import without third-party sync, a private calendar feed, and an official account nobody can imitate.
5 min
Security & PrivacyBuilding auth for an app that holds health data
RS256 access tokens held only in memory, rotating refresh tokens with reuse detection, CSRF on cookie transport, TOTP with replay protection, and the gaps we have written down rather than hidden.
4 min
Security & PrivacyOne session cookie across every subdomain
Why the session cookie uses __Secure- rather than __Host-, why SameSite=Lax is enough, and the rule it forces on the whole domain.
1 min