Security

A plant's stock levels, margins and customer list are exactly the things a competitor would like to see. What follows is what the application actually does, not a statement of intent, and you can verify the first section yourself against this page.

Response headers

Set on every response, including this one. Check them in your browser's network tab or run the page through an external header scanner.

• Content-Security-Policy, scripts and styles load only from this origin, each carrying a nonce generated fresh for the request. No inline script without that nonce runs, which shuts down most injection attempts.
• Strict-Transport-Security, two year max-age, subdomains included, preload set. After the first visit the browser refuses plain HTTP.
• X-Content-Type-Options, nosniff. The browser respects the declared type rather than guessing.
• X-Frame-Options, DENY. The dashboard cannot be framed, which rules out clickjacking.
• Referrer-Policy, strict-origin-when-cross-origin, so internal paths never leak to third parties.
• Permissions-Policy, camera, microphone, geolocation and payment switched off. The application needs none of them.
• Cross-Origin-Opener-Policy, same-origin, isolating the browsing context.
• Cache-Control, no-store on every authenticated page, so plant data is not left in a shared machine's cache.

Accounts

Passwords are hashed with a salted one-way function, never stored or logged in the clear. A new password must be twelve characters with upper case, lower case, a digit and a symbol.

Six failed attempts locks the account for fifteen minutes, which makes credential stuffing impractical without locking honest people out for long. Seeded and reset passwords are temporary: the account reaches no page other than the change-password screen until a new one is set.

Who can see what

Every query is scoped to a plant. There is no code path that returns another plant's records, and Enterprise can run a wholly separate database.

Five roles run from viewer to owner. A supervisor can run the floor without seeing margins; a viewer sees everything and changes nothing.

Requests and callbacks

Every state-changing form carries a CSRF token tied to the session. The USSD and SMS callbacks are exempt by necessity, a telco cannot carry your token, and are instead rate limited and validated. Rate limiting is applied per address across the application, tighter on sign-in and on the telco callbacks.

The audit trail

Who did what, when, and from which address. Written for every meaningful change and not editable from the interface at all. It is the reason a disputed stock figure can be traced back to the session that entered it.

What we do not load

Nothing comes from an analytics network or a CDN except the font files. There is no tag manager and no session recorder. Workers' phone numbers are never shared between plants and are never used for marketing.

Reporting a problem

If you find something, tell us before you tell anyone else. Write to info@winebald.tech with SECURITY in the subject and enough detail to reproduce it. We confirm receipt within two working days and will not pursue anyone who reports in good faith and gives us reasonable time to fix it.

Current service state is on service status.