Security
What we actually do to keep your account and data safe.
Firebase Authentication
Sign-in is handled by Google Firebase Authentication. You can use Google, GitHub, or Email/Password. Firebase manages credential storage, token issuance, and session handling - we do not store passwords ourselves.
TOTP Two-Factor Authentication
You can enable Two-Factor Authentication in your account settings. It uses the standard TOTP (Time-based One-Time Password) protocol, compatible with any authenticator app such as Google Authenticator or Authy. Enabling 2FA means your account cannot be accessed with a password alone.
Firebase App Check with reCAPTCHA Enterprise
Every request to our backend APIs is validated by Firebase App Check, enforced with Google reCAPTCHA Enterprise. This blocks automated scripts, bots, and abusive clients from hitting our backend - only verified instances of the Link Hooker app can make API calls.
Brute-force protection
Firebase Authentication automatically blocks brute-force login attempts from malicious actors. We also provide UI-level rate limiting for accidental submission prevention.
Firestore security rules
All data in Firestore is scoped to the authenticated user's UID at the database rules level. No cross-user data access is possible. A signed-in user can only read and write their own hooks, folders, and tasks - not anyone else's.
Data isolation
Your hooks and tasks are readable only by your own authenticated session. Firestore rules enforce this at the infrastructure level, not just the application level, so there is no application-layer bypass possible.
Continuous Vulnerability Scanning
We actively monitor our codebase using industry-standard Static and Dynamic Application Security Testing (SAST/DAST) tools. This ensures proactive identification and resolution of potential vulnerabilities before they can affect our users.
If you discover a security issue or have a concern about how we handle data, please contact us at mylinkhooker@gmail.com. We take every report seriously.