Security

PageComment runs on Cloudflare Workers. Boards, accounts and teams live in Cloudflare D1, and uploaded files and saved copies of pages in Cloudflare R2. Cloudflare encrypts both at rest.

Every connection uses TLS. A plain http request is redirected to https, and every response carries a Strict-Transport-Security header, so browsers stop trying http at all.

There are no passwords. You sign in with a link sent to your email address, which works once and expires after 15 minutes. We store only a hash of each link and each session, so a copy of the database holds nothing that signs anyone in.

The session cookie is HttpOnly, Secure and SameSite=Lax, and lasts 30 days from when you last used it. Agent keys for a team are stored as hashes too, and shown once when they are made.

A board opens to anyone holding its link, whose id is 21 random characters. A team can close one to its members, or to the people it invites. The server checks that on every request, at the WebSocket upgrade and inside the live session itself, and answers anyone else as if the board did not exist.

Closing a board takes effect at once. People who already had it open and can no longer read it are disconnected.

A page captured with the browser extension, such as one behind a sign-in, is private from the moment it is saved. Its board closes to its team or its invitees for good, and can never be opened by link alone.

Each open is logged with who opened it and when, and a team can read that log. A team also chooses how long it keeps these pages.

When PageComment opens a page for you, our servers fetch it without your cookies or session. A guard refuses addresses on loopback, private network ranges and cloud metadata hosts, so a link cannot point our servers at an internal network.

A board shows a saved copy of the page. The copy is served under a Content-Security-Policy that runs no script and fetches nothing from anywhere, so a captured page cannot execute code or call home. Files are served with their type checked from their contents and with nosniff set.

Credentials a team gives us for Jira, Shortcut, Basecamp or Slack are sealed with AES-GCM under a key held as a secret outside the database. A copy of the database alone opens none of them. Payment webhooks from Stripe are accepted only with a valid signature.

Uploads are metered per network. To count them we store a salted one-way hash of the internet address, never the address itself. The salt is random and kept in the database, outside the source code.

Boards and projects outside a team are deleted 90 days after they were last opened, with their saved copies. Expired sign-in links, invitations and sessions are removed every day. The legal page has the details.

These services process data on our behalf. The integrations receive data only after a team connects them, and webhooks go only to addresses a team sets.

If you find a security problem, write to hello@pagecomment.com with what you found and the steps to reproduce it. We read every report and reply to the address it came from.

Test only against boards and teams you made yourself. Leave other people’s data alone, and do not run load or denial of service tests. Give us a reasonable time to fix a problem before you publish it.

Our contact details are also published at /.well-known/security.txt.