Security
Built secure by default
Your business and your customers trust you with their time and their details. Here's how we protect both.
🔑 Passwordless sign-in
No passwords means no weak, reused or leaked passwords. You sign in with a single-use magic link that expires after 20 minutes and is invalidated as soon as it's used.
#️⃣ Hashed tokens
Sign-in links, session identifiers and customer booking links are random 256-bit values. We store only their SHA-256 hashes, so even a database leak wouldn't let anyone sign in.
🔒 Encryption in transit
All traffic to freecita.com is served over HTTPS with HSTS. Emails are sent over TLS-encrypted SMTP connections.
🛡️ Hardened web app
Strict Content-Security-Policy, CSRF protection on every form, same-site and HttpOnly cookies, clickjacking protection and strict input validation.
🚦 Abuse protection
Rate limiting on sign-in and booking, protection against email link scanners, and spam traps on public forms.
📦 Minimal data
We only store what's needed to run your bookings. Delete your account at any time and all associated data is removed immediately.
Infrastructure
Freecita is a single, memory-safe Go application backed by PostgreSQL. It runs as a non-root user in a minimal, distroless container image with no shell, reducing the attack surface to the bare minimum. Database access uses parameterised queries throughout, preventing SQL injection.
Your responsibilities
Because access to your account depends on your email inbox, please protect your business email with a strong password and two-factor authentication. Sign out on shared computers.
Responsible disclosure
If you believe you've found a security vulnerability in Freecita, please email [email protected] with the details and steps to reproduce. We ask that you:
- give us reasonable time to investigate and fix the issue before any public disclosure;
- avoid accessing or modifying data that isn't yours, degrading the service, or social engineering;
- don't run automated scanners that generate large volumes of traffic or emails.
We will acknowledge your report, keep you updated and credit you if you wish. Our security.txt is available for automated tooling.