Specify Work Security Policy

Last Updated: 2026-07-14

This page describes security-relevant controls visible in the current Specify Work application. It does not promise a particular encryption standard, audit schedule, certification, response time, safe-harbor program, or vulnerability reward.

Current application controls

• Browser requests use authenticated identity before accessing product routes and Convex functions.
• Durable product records are tenant-scoped. Authorization checks combine actor type, tenant, scopes, record visibility, membership state, and, where applicable, an explicit Life grant.
• Agent credentials are scoped, expiring, and revocable. Secret values are stored as hashes, and list operations do not return those hashes.
• Machine writes use idempotency keys and correlation identifiers to reduce accidental duplicate effects and support investigation.
• Consequential proposals can be routed through typed approvals. Executable approvals run with the approving human's authority rather than inheriting additional agent authority.
• Product-domain mutations record append-only audit events through a restricted write boundary.
• The machine HTTP surface validates methods and media types, bounds request bodies and result counts, and avoids returning unknown internal error details.
• Optional telemetry is configured without browser session replay, analytics autocapture, or default error-monitoring PII. Product code must still avoid placing content or secrets in logs and events.

These controls reduce risk but do not make the service immune to vulnerabilities, operator error, dependency compromise, or data loss.

Protecting your account

• Protect the authentication account you use to sign in and enable its available security features.
• Never share session cookies, agent keys, or copied secrets.
• Give agents only the scopes they need, use expiry, and revoke credentials when a client is no longer trusted.
• Review the command and target shown in an approval request before approving it.
• Use explicit Life grants sparingly and revoke them when access is no longer needed.
• Do not paste credentials or sensitive unrelated data into Work, memory, logs, screenshots, or support messages.

Reporting a suspected issue

Use the contact page to report a suspected security or privacy issue. Include a concise description, affected route or feature, impact, and reproducible steps when safe to do so. Do not include live credentials, agent keys, session cookies, unnecessary personal information, or data belonging to another user.

Do not disrupt the service, access data you are not authorized to access, persist after identifying a vulnerability, or use a report as permission for testing that would otherwise be unauthorized. Receipt, investigation, response timing, disclosure coordination, credit, and any reward are not guaranteed by this policy.

Policy changes

This policy may be updated as the application and its controls change. The date above identifies the latest published revision.