Security at LiveSlide.Pro

Workshop personalization works only if presenters and participants trust the service with their data. Here is what we do.

Authentication and access

  • Email/password accounts use bcrypt with cost factor 12.
  • Sign-in with Google uses OAuth 2.0 with a single-use state value tied to your browser session, and we check the identity token's audience, issuer and expiry.
  • Session cookies are HttpOnly, Secure (in production), and SameSite=Lax.
  • Account lockout after 5 failed attempts; 15-minute cooldown. Sign-in, sign-up and password-reset attempts are also rate limited per network address and per email.
  • Password-reset links work once, expire after 2 hours, and are stored only as hashes. Resetting your password signs you out on every other device.
  • Signed-in sessions are re-checked against your account about once a minute, so removing a teammate or changing their role takes effect right away.
  • CSRF tokens on every form that changes data.
  • The browser deck, its presenter-notes window, and the deck data behind them open only for signed-in members of the workspace that runs the session. Slide edits from the notes window need the same access and a CSRF token.

Data in transit and at rest

  • TLS on every connection to the site, with HTTP redirected to HTTPS.
  • HSTS with preload directive in production.
  • Google is optional. If you connect it, Google access and refresh tokens are encrypted in the database with AES-256-GCM, using a key kept outside the database and outside the web root.
  • Google tokens are deleted when you disconnect Google from your Account page.

Application security

  • Strict Content Security Policy with per-request nonces for inline scripts.
  • X-Frame-Options: DENY (we do not embed in third-party iframes).
  • Input validation at every boundary; prepared statements for every SQL query.
  • HTML-escaping enforced by helper functions on all output.
  • Honeypot field and reCAPTCHA on public forms to catch bots.
  • Rate limiting on participant submissions, sign-in, password resets, and the contact form.
  • When you give us a reference page to read, our server fetches only public web addresses on standard ports, re-checks every redirect, and caps the size and time of the download.
  • PayPal webhooks are accepted only after PayPal confirms their signature, and a paid plan starts only once PayPal reports the subscription active.
  • Spreadsheet exports neutralize cells that would otherwise run as formulas.

Privacy by design

  • Participants do not need an account or email.
  • IP addresses are stored as SHA-256 hashes only, never raw.
  • Default 30-day retention with automatic anonymization.
  • Google access is used only for Google Slides files, and the Drive scope is limited to drive.file, so we can open only files our app creates.
  • PowerPoint downloads are built in your own browser from a copy of the library we host ourselves.
  • PowerPoint files, offline copies, and PDFs include attendee names and goals. Store them as carefully as any other attendee list, and delete them when you no longer need them.

Reporting a vulnerability

If you believe you have found a security issue, please email security@liveslide.pro. We will acknowledge within 48 hours and aim to resolve verified issues within 30 days. We do not pursue legal action against good-faith researchers.