Sheet 1, security
Your register holds compliance dates and owner names, not the underlying evidence. Here is what I actually do to protect it.
Every connection to Due Badger is over HTTPS, enforced with HSTS. Your data is never sent in the clear.
Passwords are hashed with PBKDF2-HMAC-SHA256 and a unique salt per account. I never store them in plain text and cannot see them, so I cannot tell you your password, only help you reset it.
Every record belongs to one account, and that check runs in the database query itself, not only in the interface above it. One account cannot read or touch another's register, and the same rule applies to every MCP tool.
Sign-in uses a signed, HttpOnly, Secure session cookie. Changing your password signs you out of every other device, and deleting your account removes your data.
Due Badger stores obligation titles, due dates, references, owner names, criticality, recurrence, completion notes, redate reasons, and any evidence link you paste in. It does not store the evidence itself. There is nowhere in Due Badger to upload a document, only a link to where the real record already lives. That is a materially smaller amount of sensitive material sitting in one place than a system built to hold the documents directly.
Due Badger runs entirely on Cloudflare: Workers for compute, D1 for the database, KV for sessions and rate limiting, and Durable Objects for the daily scheduler and the MCP connection. There are no servers of mine sitting around to be misconfigured.
Sign-up and sign-in are rate limited. A Cloudflare Turnstile bot check will run on those pages once it is switched on. Every page is served with a strict set of security headers, including a locked-down Content Security Policy.
Found something? I would genuinely like to hear about it. Email dalemooney50@gmail.com, also listed in my security.txt, and I will work with you to fix it.
No online service is perfectly secure. I keep improving this one, and I will tell users promptly if anything material happens to their data.