Security

Your tasks stay yours

Done is built for a world where AI agents share your task list — so isolation, scoped access, and human approval aren't features, they're the foundation.

Account isolation

  • Every task, project, and tag is scoped to your workspace membership. A query can only ever return rows your account is allowed to see — there is no path that reads across accounts.
  • The internal creator/attribution column is stripped before any row leaves the data layer, so it's never part of the API surface.
  • Shared workspaces and per-project sharing are opt-in: a teammate sees only what you invite them into, nothing else.

Authentication

  • Passwords are hashed with argon2id — never stored in the clear. Auth is per account, not a shared environment secret.
  • Turn on two-factor authentication (TOTP) and a stolen password isn't enough to sign in. It's enforced on password reset too, so inbox access alone can't take an account over, and you get ten single-use recovery codes for a lost device.
  • Sessions are per-account and cookie-based; each session resolves to exactly one user, and every request is scoped to that user.
  • The whole site is same-origin and served over HTTPS with a strict Content-Security-Policy — inline scripts run only under a fresh per-request nonce, so an injected script won't execute.

Agent access & tokens

  • Every account gets its own MCP endpoint and its own tokens. There is no shared or global token — a token only ever sees its own account's data.
  • Scope a token down to read-only or a single project, so an agent gets exactly the access it needs and nothing more.
  • Connect over OAuth 2.1 (Done is a full authorization server for its MCP endpoint) or a bearer token. Regenerating or revoking a token invalidates it immediately.
  • Changing or resetting your password revokes every API credential too — MCP tokens and connected apps — so recovering from a suspected compromise doesn't leave agent access quietly alive.

You approve every result

  • A gated task can't close itself. An agent proposes a plan before substantial work and a summary before completion; nothing reaches done without your approval in the Control Room.
  • Only a human can make a task auto-approvable — an agent can't lift its own gate.
  • Every agent session is logged as a run with its tool-call and time budgets, so you can see exactly what ran and cap how far it goes.

Your data

  • Data lives in Cloudflare D1 (edge SQLite), served by a single Worker — no separate backend passing your data around.
  • Deleting a task moves it to Trash with a 30-day window to restore, not an instant hard delete.
  • Export your tasks as CSV or Markdown at any time, and delete your account (with all its data) yourself from the app.

Slack & third-party connections

  • The Slack app links per user and only after you, signed in to Done, confirm it — a Slack identity can't be bound to an account without the owner's consent.
  • Every inbound Slack request is verified with Slack's signing-secret signature, and replayed (stale) requests are rejected.
  • Google Calendar is read-only busy-time sync and is entirely optional; nothing is connected unless you connect it.

Found something?

Report a security issue privately to and we'll get back to you. Please don't open a public issue for anything exploitable.