Built with care.
Helios Gather treats forms and responses as potentially sensitive. The controls below describe the existing controls; they are not a security certification.
Workspace isolation
Every protected form, response, export, event, and audit operation is scoped server-side to the authenticated workspace. The UI is not treated as an authorization boundary. Cross-workspace access attempts are covered by tenant-isolation tests.
Authentication and sessions
Email and password remains the current temporary deployment adapter. Lucion Identity sign-in uses OpenID Connect authorization code with PKCE and verifies Lucion Global workspace membership through Identity's self-scoped organization memberships API. Passwords are hashed with PBKDF2-SHA-256, sessions use opaque tokens stored as hashes, and session cookies are HttpOnly, SameSite=Lax, and Secure in production.
Forms and responses
Published forms use immutable versions. Submissions are validated on the server against the published schema, bounded in size, and stored with the form version that received them. Response exports require workspace authorization and mitigate spreadsheet formula injection.
Application defenses
Production responses use safe error messages, structured request-scoped logging, security headers, output-escaped React rendering, runtime validation with Zod, and protected D1 database access. Public routes expose only published form data and bounded submission behavior.
Operational boundaries
File uploads accept PDF, JPEG, and PNG files up to 5 MB each, validate signatures server-side, and store private chunks in D1 under a 100 MB deployment-wide cap. Files download only through workspace-authorized response routes. Durable upload rate limiting, malware scanning, automated orphan cleanup, and an approved retention schedule are not yet available. Arbitrary HTML, webhooks, payments, public API keys, and child-data workflows are also excluded. Email verification, password recovery, MFA, centralized alerting, tested restore exercises, and an external penetration test remain release hardening work.
Report a concern
Report suspected vulnerabilities privately to the Lucion Global security contact rather than publishing exploit details. Include a safe description, affected route, reproduction steps, and a way to follow up. Do not include real passwords, session tokens, or private response content.