Report a security issue
Please include the affected URL or component, reproduction steps, expected and observed behavior, and the practical impact. Munch does not authorize destructive testing, social engineering, denial-of-service testing, access to other users' records, or retention of data obtained during testing.
Implemented controls
- HTTPS and secure production cookies
- Passwordless, expiring, single-use sign-in links
- OAuth authorization with signed transactions and PKCE
- Revocable access and refresh-token families
- Forced PostgreSQL row-level security for personal and household records
- Same-origin protections for website mutations
- Rate limiting and bounded request bodies
- Verified Stripe webhook signatures
- Hashed invitation and export tokens
- Private, time-limited exports
- Sanitized user-facing errors and bounded operational logging
Data and system boundaries
Munch stores application data on Railway PostgreSQL and uses Railway to run the service. Resend delivers sign-in messages. Stripe handles website payment methods and invoices. USDA FoodData Central and Open Food Facts receive food-search or barcode requests when used. ChatGPT conversation processing is controlled separately by OpenAI.
Personal meal, hydration, weight, goal, and saved-food records are isolated from other users. Household sharing is limited to explicitly shared recipes, meal plans, groceries, membership names, roles, and related attribution.
Limitations
No internet service can guarantee absolute security. Munch does not claim zero-knowledge storage, end-to-end encryption, HIPAA-covered clinical operation, or immunity from provider, software, configuration, or human failure. Nutrition values and model-assisted estimates are not medical advice.