Security
Taskora is a demo, but it is built with the same security practices we would use for a production marketplace. This page describes the most important safeguards and how to report a vulnerability.
1. Accounts and passwords
Passwords must be at least 10 characters and contain a letter and a digit. They are hashed with scrypt and a unique random salt; we never store or log plain-text passwords. Login responses do not reveal whether an email address has an account, and repeated failed logins are rate limited.
Password resets use single-use tokens that expire after one hour and are stored only as hashes. Completing a reset signs the account out on every device.
2. Sessions
Sessions use a random 256-bit token in an HttpOnly, Secure, SameSite cookie with the __Host- prefix. Only a SHA-256 hash of the token is stored, so a database leak would not expose usable sessions. Sessions are rotated on login, expire after 14 days and can be revoked individually in Settings.
3. Request protection
Every request that changes data must carry a custom header and come from Taskora’s own origin; other requests are rejected, which protects against cross-site request forgery. All input is validated and length-limited on the server, request bodies are capped, and every endpoint checks that you own or participate in the record you access.
Rate limits apply to the API as a whole and, more strictly, to sign-up, login, contact, uploads, reports and messages.
4. Uploaded files
Uploads are limited to 10 MB and to a short list of file types, which are verified by their actual content (magic bytes), not by name or declared type. Files are stored under random names outside the web root and served with nosniff and a sandboxing Content Security Policy; everything except images is delivered as a download.
5. Browser security
Taskora sends a strict Content Security Policy that only allows scripts, styles, fonts and connections from its own origin, and forbids framing. It also sends HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, Cross-Origin-Opener-Policy and Cross-Origin-Resource-Policy headers. User content is always rendered as text, never as HTML.
6. Payments
No payment provider is connected and no payment data is collected. All money movement in the demo is simulated. In a production deployment, card data would be handled exclusively by a PCI DSS–certified payment provider and would never touch Taskora’s servers.
7. Moderation and abuse
Users can report profiles, jobs, messages and reviews. Moderators review reports, can hide content and suspend accounts, and resolve contract disputes. Administrative areas are available only to accounts with the admin role and are not discoverable by other users.
8. Responsible disclosure
If you believe you have found a security vulnerability, please email contact@adscaled.media with a description, the steps to reproduce it and the potential impact. We acknowledge reports within 3 business days and keep you informed while we fix the issue.
Please test only against your own accounts or the shared demo accounts, do not access or modify other users’ data, do not run denial-of-service or high-volume automated scans, and give us reasonable time to fix an issue before disclosing it publicly. We will not pursue legal action against research carried out in good faith within these rules.