Security
dwgtree stores engineering drawing structures — item numbers, titles, review status, and who is responsible for each part. That is working information about projects in progress, and it is treated as such.
This page describes how the application is built and operated. It is written to be accurate rather than reassuring; where a limit exists, it is stated.
Reporting a vulnerability
Email security@dwgtree.com.
Please include enough detail to reproduce the issue. You will get a human reply. There is no bug bounty program — this is a small application maintained by one person — but reports are taken seriously and acted on.
Please do not test against other people's accounts or data.
If something goes wrong
If a security incident affects your data — unauthorized access, or a loss of data we cannot recover — you will be notified by email at the address on your account, within 72 hours of the incident being confirmed.
The notice will say what happened, what data was involved, and what you should do. It will be sent whether or not anyone else has noticed.
Accounts and authentication
Passwords are hashed with argon2id. They are never stored in recoverable form and never written to logs.
Email verification is required. A new account cannot sign in until the address is confirmed by clicking an emailed link. Verification links are single-use and expire.
Sessions are cookie-based, with the cookie marked httpOnly, Secure, and SameSite. Session tokens are stored hashed — a database dump does not yield a usable session. Sessions expire after 30 days of inactivity and cannot be renewed past 90 days from issuance, at which point signing in again is required.
Repeated failed sign-ins are throttled and then locked out. Rate limiting applies per account and per source address; a locked account unlocks itself after a short interval rather than requiring intervention.
Password reset is by emailed single-use link with a one-hour expiry. Completing a reset invalidates every existing session for that account, so a password change actually ends any other sign-in.
Responses do not reveal whether an address has an account. Sign-in, registration, password reset, and verification-resend all answer identically for known and unknown addresses. This is deliberate: it means the application cannot be used to discover who has an account.
Your data
Every request is scoped to the signed-in user. Items, links, projects, types, statuses, and settings are filtered by account on every read and write. There is no administrative interface that reads across accounts.
Deleting your account deletes your data. Account deletion is available from the account page, requires your password, and is immediate — every item, contains-link, project, type, status, display setting, and session is removed. There is no soft delete, no grace period, and no recovery.
Imported files never touch the server's filesystem. When you import an existing BOM, the file is parsed in your browser and sent as data. Nothing is uploaded, stored, or executed as a file.
Text you enter is escaped when displayed. Item titles and other free text are inserted as text, not as markup.
Database queries are parameterized through an ORM. Queries are not assembled by string concatenation.
Infrastructure
dwgtree runs on Render, with PostgreSQL managed by Render in the US West (Oregon) region.
Encryption. Render encrypts Postgres data at rest with AES-256, covering the database and its backups. Connections are encrypted in transit.
The database is not reachable from the public internet. External access is blocked at the infrastructure level, and that restriction is declared in version-controlled configuration rather than set by hand, so it cannot be silently reverted by a configuration sync. The application reaches the database over a private network.
Backups. Point-in-time recovery is available to any timestamp within the past 3 days. Logical exports can be taken on demand and are retained for at least 7 days. Longer-horizon and off-site backups are planned but not yet in place — stated here because a 3-day window is a real limit, not a formality.
Secrets — database credentials, the session signing secret, and the outbound mail token — are held in the hosting environment's secret storage. They are not in the source repository.
Outbound email (verification and password reset) is sent through Postmark from a domain with DKIM and Return-Path verified.
What this application does not do
- No sharing. Trees are private to the account that owns them. There are no public links and no way to grant another user access.
- No third-party analytics or trackers.
- No selling or sharing of your data.
- No payment information is handled — dwgtree does not process payments.
Known limits
Stated plainly, because a security page that lists only strengths is not informative.
- Backup retention is 3 days for point-in-time recovery. Off-site backup is planned, not implemented.
- There is no undo and no version history. Structural edits take effect immediately. Deleting an item from the data-entry page removes it everywhere it is used, after a warning showing how many assemblies it appears in.
- Account deletion is irreversible and immediate. There is no window in which it can be cancelled.
- This is a single-maintainer application. Response times to reports depend on one person's availability.
Changes to this page
This page is updated when the practices it describes change. It reflects the application as deployed, not as intended.
Last reviewed: August 13, 2026