Security

Every account's data, books, tasks, ARC readers, mailing lists, is isolated at the database level using Row Level Security, enforced by the database itself regardless of what the application code does or doesn't check. This was verified directly: real attempts to read or write another account's data from outside the app were tested and confirmed blocked, not just assumed safe from reading a policy file.

• New account creation is gated by Cloudflare Turnstile, a bot check that doesn't require clicking on stoplights or crosswalks.
• Ordinary actions inside the app, adding a task, an ARC reader, a roadmap milestone, are rate-limited per account, so a compromised or scripted account can't loop indefinitely.
• Public forms that need no login at all (an ARC signup link, a mailing-list signup link) are separately rate-limited by connection, so they can't be used to flood an author's data or send spam through Ledger's own email account.

Stripe and SendGrid both send Ledger real-time notifications behind the scenes, a payment succeeded, an email was opened. Both are cryptographically signed, and Ledger verifies that signature before trusting anything in them. A request claiming to be one of these that isn't properly signed is rejected outright, never processed.

The Feedback Digest reads what your ARC readers, people who never need a Ledger account themselves, wrote about your book, and summarizes it for you. That text is treated strictly as content to summarize, with an explicit instruction against following anything written inside it as a command, so a bad-faith submission can't quietly steer the summary shown back to you.

Passwords require a minimum of 8 characters, and authentication itself, the actual login and session handling, is run by Supabase, not custom code written for this app.

Tell us directly at ledger.app101@gmail.com. This page gets revisited any time something changes, not written once and left.