Security

Access control

In short: You only see units you belong to, at the level your role allows — checked on the server every time.

• Nobody can join a unit without a join code and an admin's approval.
• Three roles keep things simple: Admin (manages the unit and its members), Leader (edits rosters and advancement), and Viewer (read-only, without youth contact details, birth dates, schools, guardians, notes, or descriptions of service done outside unit events).
• Every page and every change is checked on our servers against your role in that specific unit. Hiding a button is never the only protection.
• Every unit must always have at least one admin, and admins can remove access instantly.

Accounts and passwords

In short: Strong passwords, hashed storage, limited sign-in attempts, and sessions that expire.

• Passwords must be at least 12 characters, and common or breached-pattern passwords are refused.
• Passwords are stored only as salted, one-way hashes. Nobody at ScoutHitch can see your password.
• Repeated sign-in attempts are rate limited to stop password guessing.
• Sessions use secure, HTTP-only cookies and expire after 7 days without activity.

Protecting data

In short: Encrypted in transit and at rest, minimal collection, no third-party trackers.

• All connections use HTTPS with HTTP Strict Transport Security.
• Data is encrypted at rest by our database provider.
• We collect only what the app needs. There are no ads, analytics trackers, or third-party scripts, and our Content Security Policy blocks pages from loading code from anywhere else.
• Every input is validated on the server, and all text you enter is safely escaped when displayed.
• Photos and videos are stored privately and only ever sent to signed-in members of their unit, checked on every request. Location data and other hidden details are stripped from every photo, and videos that still carry a location are refused. Files are checked by their contents, not their names.
• Posts and comments are shown only to members of their unit. Links in them are plain links to exactly the address written — ScoutHitch never fetches the linked page or shows previews from other sites, so nothing about you or your unit is sent to them.
• People a unit records as interested in joining are shown only to that unit's Admins and Leaders — never sent to Viewers — and are deleted automatically a year after they were last updated.
• Repair photos on Quartermaster are stored privately like unit photos (location data removed, sent only to members of the unit), but belong to the repair alone and never appear in Photos.
• Fundraisers are shown only to members of their unit. Any member can sign themselves up for a shift, but only the unit's Admins and Leaders can change a fundraiser or put someone else on a shift, and every change is checked on the server.
• Security-relevant actions are logged so misuse can be investigated. Logs are deleted after 1 year.
• Offline copies saved on your device hold only what your role can already see. They are deleted when you sign out, when someone else signs in on that browser, when your session has ended and the device next goes online, or after 14 days. Changes made offline are checked again by the server — permissions included — when they sync.

How we build

In short: Security and accessibility checks run automatically on every change.

• Automated tests check permissions, input validation, security headers, and policy acceptance on every change.
• Dependencies are only installed after they have been public for at least a week, to avoid supply-chain attacks.
• Every change is reviewed against a written security and accessibility checklist.

What you can do

• Use a unique password (a password manager makes this easy).
• Sign out on shared computers (this also removes offline copies), and lock your phone — offline copies are only as safe as the device they're on.
• Lost a device? Use “Sign out of all devices” on the Account page.
• Admins: review your unit's members regularly and remove anyone who no longer serves.
• Never enter medical, financial, or government ID information.

Reporting a security problem

In short: Email us. We'll respond quickly and won't take action against good-faith research.

If you believe you've found a security vulnerability, or that someone has accessed information they shouldn't, email security@scouthitch.com. We acknowledge reports within 5 business days.

Please don't access, change, or keep other people's data while investigating, and give us a reasonable time to fix the issue before sharing it publicly. We will not pursue action against anyone who reports in good faith and follows these guidelines.