Security at FamilyFreely

Report a security issue

Send a private report to security@mapellab.app with the affected URL, a concise reproduction, and the impact. Do not include real family, child, banking, authentication, or notification data. Please do not publish an unresolved vulnerability or test against another household without explicit authorization.

Account protection

• Email links and one-time codes expire, are single-use, rate-limited, and stop after three failed code attempts.
• Passkeys support device biometrics without sending biometric data to FamilyFreely.
• Authenticator-app codes can be enabled as an email-independent option and reject replay.
• Sessions and devices can be revoked, and production secrets are kept outside client code and source control.

Household boundaries

• Every household request requires an active membership and an explicit capability.
• Full, shared, and assigned visibility scopes are enforced by the API as well as the interface.
• Owners can deactivate and restore access, revoke membership, or transfer ownership to another adult.
• Sensitive actions create owner-visible audit records; corrections preserve the original history.

Data integrity

Financial imports, offline transaction reconciliation, recurring posts, point changes, reward decisions, account deletion, ownership transfer, selective reset, and complete budget setup use idempotent or atomic database workflows. This prevents a retry or partial network failure from silently duplicating or half-applying a sensitive change.

Family-safety controls

Response cost is disabled by default, separately permissioned, capped, unable to create a negative balance, reversible, and unavailable for basic-needs themes. Children can privately question an entry. AI has no tool or permission to apply points, deductions, rewards, financial changes, or access decisions.

Scope and limitations

No service can promise absolute security. Operators must keep runtime secrets current, rotate notification credentials when required, review provider settings, monitor authorization and database errors, apply additive migrations in order, and rehearse rollback before production promotion. Security fixes should be deployed promptly after review.