Security

• Encrypted in transit and at rest: all traffic runs over HTTPS, and stored data is encrypted by our database provider.
• Row-level isolation: every table enforces row-level security, so your profile, settings, recipes, cook log, pantry, and shopping list are only ever readable by you.
• Managed authentication: sign-in is handled by Supabase Auth via magic links, Google, or a password we never see in plain text. We don't roll our own auth.
• Least privilege: admin database keys live only on the server, never in your browser, and endpoints that cost money or invite abuse (extraction, voice, photo scanning, feedback) are rate-limited.
• Nothing kept that isn't needed: voice clips and pantry photos pass through for analysis and are discarded; they're never written to storage.

If you believe you've found a security issue, please tell us before disclosing it publicly. Email security@expo.cooking with steps to reproduce, and we'll acknowledge it as quickly as we can. You can also reach us through the help form.

Please give us reasonable time to fix the issue, only test against your own account, and avoid accessing other people's data, degrading the service, or running automated scans that disrupt others. Acting in good faith within these limits, we won't pursue action against you.

Our security.txt follows RFC 9116 with the same contact details.