Security

Public capability, private machinery

CowBoyUp is designed local-first. Livestock records stay on the device unless you export a backup or use a future encrypted account sync that you explicitly enable.

What we do today

• HTTPS everywhere on cowboyup.app and api.cowboyup.app
• Session cookies for web accounts; passwords hashed server-side
• Stripe handles card data — CowBoyUp never stores full card numbers
• Production browser builds ship without source maps
• Release artifacts are scanned for secrets and forbidden files before ship
• /app/ is disallowed in robots.txt (authorization still required server-side for private APIs)

What we are finishing

• Encrypted SQLite on native phones (not localStorage alone)
• Encrypted backup with passphrase
• File vault outside the row database (photos/PDFs)
• Idempotent multi-device sync with visible conflict resolution
• Signed ownership-transfer events

See the production hardening notes in the open-source release process for gate status.

Vulnerability reports

Email [email protected] with subject line CowBoyUp Security.