Encryption in transit and at rest
All connections to FormsBat use TLS (HTTPS), with HSTS so browsers never fall back to plain HTTP. Our database (MongoDB Atlas) and file storage (Cloudflare R2) encrypt data at rest. Files are stored privately and can only be opened through the owner's account or the share links the owner creates.
Passwords and two-factor sign in
- Passwords are hashed with scrypt and a random salt per password, and compared in constant time. We never store or log them in readable form.
- Two-factor sign in with an authenticator app (TOTP) is available, with one time recovery codes that are stored only as hashes.
- Sign in, password reset and email codes have per network and per account rate limits to stop guessing.
- Email verification and password reset links are random, stored only as hashes, expire and work once.
- API keys are shown once and stored only as hashes.
Session security
Sessions use a random id in a signed cookie that scripts cannot read (HttpOnly), that is not sent on cross site requests (SameSite) and that only travels over HTTPS. A new session id is issued at every sign in, sessions expire after 14 days, and changing or resetting a password ends every session. Requests that change data must come from our own site.
Sandboxing and file cleaning
- Custom HTML and CSS: custom HTML in forms is cleaned of scripts and event handlers, and custom CSS is cleaned and scoped so it can only style its own form. Previews run in sandboxed frames.
- Strict Content Security Policy: our pages only run our own scripts.
- Uploaded files: files are served with a sandbox policy so they cannot run scripts on our site, and only PDFs and images open in the browser.
- SVG cleaning: SVG images are stripped of scripts and other active content.
- Photo metadata: photos uploaded to forms have their EXIF, XMP and IPTC metadata removed, including GPS location, before they are stored.
- Untrusted documents: PDF processing runs in separate worker threads with time and size limits.
Sealed signed documents
Every signed PDF includes an audit trail (signers, network addresses, browsers, times and document hashes) and is sealed with a digital signature, so any later change to the file can be detected.
Webhooks, rate limits and spam protection
- Webhooks are signed with HMAC SHA-256 and a timestamp, so you can check that each one came from FormsBat and was not replayed.
- Requests to addresses you give us (such as webhook URLs) must use HTTPS and cannot reach private or internal networks.
- Every API, sign in, email and tool route has rate limits.
- Forms are protected from spam with a hidden honeypot field, a minimum fill time and signed start tokens, and form owners can turn on Cloudflare Turnstile.
- Signature request emails have a daily budget per sender.
Access and isolation
Every form, response, file, envelope and key is tied to its owner and checked on every request. Signer links only show the fields meant for that signer. Production error messages never include internal details, and logs never contain passwords, tokens, API keys or email bodies. Only a small number of administrators can reach production systems.
Backups and recovery
Our database provider keeps regular encrypted backups, and file storage is replicated by the provider. Backups are used only to restore the service and are replaced on a rolling cycle. Deleted data can remain in backups until that cycle replaces it.
Responsible disclosure
If you believe you have found a security vulnerability in FormsBat, please email [email protected] with the steps to reproduce it, the affected address or endpoint, and the impact you observed. We reply within 3 business days.
- Do not access, change or delete other people's accounts or data. Use your own test accounts.
- Do not run denial of service, spam or social engineering tests.
- Give us reasonable time to fix the issue before you share it publicly.
We will not take legal action against research done in good faith that follows these rules, and we are glad to credit you once the issue is fixed.