Security & Safety

Account access

• The dashboard and project workspace require account login.
• New accounts must verify their email address before using the private product.
• Passwords are stored as hashes, not plaintext.
• Session cookies are HttpOnly, HMAC-signed, SameSite=Lax, and Secure in production.

Account isolation

Projects, client requests, Change Orders, uploaded files, inbox attachments, connected-account data, and Evidence Pack downloads are scoped to the owning account. LimesWorth does not currently provide team or workspace sharing. Evidence Pack download for the account owner requires login and project ownership.

Public client links

Public client links use tokenized URLs so a recipient can view and, where supported, respond to selected workflow records without creating an account. Some links can be revoked by the project owner, and some decision links are locked after a response is recorded. Exact controls depend on the workflow.

CSRF and abuse controls

LimesWorth uses CSRF protections for authenticated state-changing requests and separate validation controls for public endpoints and webhooks. Login, registration, email-verification, and public decision flows use rate limiting or other abuse controls appropriate to the workflow.

Connected accounts

Gmail, Outlook, and Slack connections are created only after you sign in to LimesWorth and complete the provider’s authorization. Gmail uses Composio as the primary connection path. Access is limited to the permissions you grant. Connections are stored on your LimesWorth account. Sync and assignment remain under your review.

Webhooks

Webhook endpoints use provider-specific validation, such as cryptographic signature checks or shared-secret validation, before trusted events are processed. Payment webhook processing is designed to handle duplicate events safely.

Files and evidence

File downloads, Evidence Packs, and related project records are checked against the signed-in owner’s account. Public Evidence Pack share links, when created, use tokenized URLs rather than account login.

Public pages and health

• The sample Change Order page uses demo screenshots and does not expose private customer data.
• Internal homepage preview routes are disabled by default unless explicitly enabled for local development.
• The public /health endpoint returns only a minimal status payload.

Secrets

Application secrets such as API keys and webhook secrets are kept in server-side configuration and are not exposed in public pages.

Third-party processing

Some protections are application-level only. AI providers, analytics, email, payment, connected-account providers, and hosting providers may process data as described in the Privacy Policy. LimesWorth does not claim encryption at rest for all stored data, GDPR certification, or EU-only hosting on this page.

Report a concern

Security or abuse concerns: hello@limesworth.com