Internal security self-assessment

Within the tested scope, the assessment found no unresolved critical or high-severity finding in the application code after remediation.

The review covered Google OAuth PKCE and single-use state, exact scope enforcement, account and tenant authorization, session and cookie security, same-origin protection, bounded Google and user input, encrypted credential storage, Gmail send idempotency, synchronization and storage capacity, service-data deletion, production security headers, tracked-secret exposure, dependencies, and automated regressions.

Production and development dependency audits reported zero known vulnerabilities. TypeScript and the production build passed, along with 56 automated tests. OAuth credentials use application-level AES-GCM encryption; session cookies are Secure, HttpOnly and SameSite; script execution uses a per-response CSP nonce; state-changing API requests fail closed without an exact same-origin Origin; and synchronized writes are bound atomically to the active account generation and lease.

This was an internal, evidence-based self-assessment. It is not an independent penetration test, CASA assessment, SOC 2 report or ISO 27001 certification, and it does not guarantee that the service is free from every vulnerability. Gmail profile data does not provide the immutable Google account identifier needed for automatic recovery without adding another reviewed identity scope, so the current beta fails closed when an existing account is reconnected without its valid Ordinal session.

Email andrea@nprit.co.kr. Do not include passwords, OAuth tokens, mailbox contents or other sensitive data in the initial report.