TaskFlow receives active security updates on the main branch.

• All user data in Cloud Firestore is strictly isolated by Firebase User UID:
  • Document path: users/{userId}
  • Subcollections: users/{userId}/tasks/{taskId}, users/{userId}/categories/{categoryId}, users/{userId}/activity/{activityId}, users/{userId}/achievements/{achievementId}
• Firestore security rules enforce:
  • request.auth != null
  • request.auth.uid == userId
  • Zero cross-user read, write, or delete permissions.

• No server-side secrets, admin service accounts, or private API keys are ever bundled or exposed in client-side code.
• .env.local is strictly excluded via .gitignore.
• Public Firebase Web SDK parameters (apiKey, projectId, appId) only identify the Firebase project and are protected by backend Security Rules and domain restrictions.

• All task, subtask, category, and profile mutations are validated against strict Zod schemas before being committed to persistent storage.

If you discover a security vulnerability in TaskFlow, please report it responsibly by contacting the maintainers directly. Please do not open public issues for sensitive security vulnerabilities.