Private where it matters.

Public pages do not require a password. Studio Operations access is checked before rendering and restricted APIs authorise again on the server, so hiding a link is never treated as the security control.

The production host stores a slow scrypt hash of the owner password rather than the password itself. Session-signing secrets and future provider tokens remain server-only environment secrets and are not committed to GitHub.

Owner sessions use Secure, HttpOnly, SameSite=Strict cookies, expire after four hours, and are protected by origin-bound anti-forgery tokens. Sign-in is limited in the application and again at the hosting edge.

Production uses HTTPS, HSTS, a restrictive Content Security Policy, clickjacking protection, MIME-sniffing protection, limited browser permissions, no-store owner responses and no-index owner metadata.

The public Studio form is paused. Owner checklists and the evidence index remain on the owner’s device; selecting a file records only its name, type, size and date, and does not upload or read its contents.

The Companies House integration is read-only. Filing, payments, payroll calculation and automatic submissions are outside the first release. Future provider connections will use narrow scopes and an audit trail.

Email hello@readytohandstudios.com with “Security” at the start of the subject. Do not include passwords, exploit code containing personal data or unnecessary private records.