Security
Your workspace holds your whole inventory, your photos and — if you use inbox sync — conversations with your buyers. Here is what protects it, described concretely enough to check, including the parts that are not finished.
01Accounts and sessions
- Password storage — PBKDF2-SHA256 at 200,000 iterations with a per-user salt. Plaintext passwords are never stored and never logged.
- Sessions — opaque random bearer tokens, not self-describing JWTs — a token carries no data and can be revoked server-side instantly.
- Deactivation — turning off a user rejects their password and their token at once, without deleting the history they authored.
- Rate limiting — sign-in, sign-up, waitlist and the AI draft route are throttled per IP, so credential stuffing is slow and expensive.
02Tenant isolation
ListLot is multi-tenant, so the question that matters is whether one dealership can reach another's data. Every tenant table carries an org_id and every query is scoped to the caller's organisation — isolation is a property of the schema, not of remembering to filter.
Photo storage keys are namespaced by a globally unique dealer id, so two lots with the same stock number cannot collide or overwrite each other.
- Three roles, enforced in the database — admin, sales and affiliate, with the role set constrained by the database itself so a typo cannot invent a fourth role that the permission layer treats as an admin.
- Least privilege by default — an affiliate sees only the packages a rep released to them. Billing, team and dealer settings are admin-only.
03Transport and browser hardening
- TLS everywhere — certificates issued and renewed automatically; HTTP is redirected, never served.
- HSTS — one year, including subdomains.
- Content-Security-Policy — scripts and connections restricted to our own origin, so an injected script cannot ship your token to another host.
- Clickjacking — frame-ancestors none, plus X-Frame-Options DENY.
- Other headers — nosniff, strict-origin-when-cross-origin referrer policy, and a Permissions-Policy that denies geolocation, microphone and payment.
04Photos
Every uploaded image is re-encoded server-side before storage, which destroys the EXIF block — GPS coordinates included. Nothing with location data in it reaches the bucket.
Stored images are served from a CDN over public URLs, because Marketplace and Craigslist fetch the image from that URL when you post. The URLs are unlisted and excluded from crawlers, but they are not access-controlled and we will not pretend otherwise.
05The Chrome extension
The extension is the most sensitive component, because it runs inside a session that has your Facebook account in it. It is deliberately small.
- One standing permission — storage. That is the entire permissions list.
- Host access on demand — access to your ListLot server is an optional host permission requested after you sign in. It ships with access to nothing.
- No credentials — it never sees, stores or transmits a Facebook or Craigslist password. It works in the session you already opened.
- Scoped content scripts — it loads only on Facebook and Craigslist, and reads only the posting form and — when you use it — the Marketplace inbox.
- No auto-submit — there is no code path that clicks Publish. This is a security property, not a preference.
06AI processing
Listing bullets and buyer-reply drafts are generated by Anthropic's Claude models. What we send is the vehicle's specs, the listing text, and — for a reply — the buyer message you asked for help with. That data is not used to train models.
Listing copy is generated once at sync time and stored on the vehicle, so the same car is not re-sent on every page load. If you would rather no buyer message ever left the workspace, do not use reply drafting; nothing else in the product sends conversation text anywhere.
07What we have not built yet
Stated plainly, because a security page that lists only strengths is marketing. If one of these is a blocker for your group, tell us — it moves up the list.
- No SOC 2 report — we are too small to have completed an audit.
- No two-factor authentication — planned. Today, account security rests on password strength and token hygiene.
- No SSO or SAML — not built. Team access is per-user invitations.
- No customer-managed encryption keys — data is encrypted in transit and at rest by our hosting and storage providers, with their keys.
- No published uptime SLA — see the terms — we would rather not promise one we cannot yet measure.
08Reporting a vulnerability
Email emery@listlot.app with “security” in the subject. Tell us what you found and how to reproduce it; we will acknowledge within three business days and keep you updated until it is closed.
We do not run a paid bounty yet. We will not pursue or support legal action against anyone who reports a flaw in good faith, stays within their own test account, avoids touching other customers' data, and gives us a reasonable window before disclosing.