SECURITY

How Annoying protects the boring-but-important stuff.

Annoying is engineered to reduce unnecessary data exposure while providing the service. Security is a process rather than a guarantee.

Current controls

• Passwords hashed using a memory-hard password hashing method.
• Secure, HttpOnly, SameSite session cookies in production.
• HTTPS enforcement and security headers in production.
• CSRF protection for authenticated write operations.
• Rate limits on authentication and sensitive endpoints.
• Strict upload type/size/page limits.
• Raw uploaded documents are processed in memory and discarded after text extraction in the launch version.
• Production is configured to require managed PostgreSQL rather than local SQLite.
• Stripe-hosted payment flow avoids Annoying handling full card numbers.
• High-entropy bearer tokens for client approval links.

Your part

Use a unique password, protect approval links, upload only information you are authorised to use, and report suspected security problems to support@annoyingwork.com.

Responsible reporting

If you believe you found a vulnerability, contact us privately and include enough detail for us to reproduce the issue. Do not access data that is not yours, degrade the service, or publicly disclose an unresolved issue in a way that increases risk to users.