Last updated October 9, 2026
Clients trust me with real access to their work. Here is how I protect it.
Your client hub
- Every hub has its own password. Passwords are stored as one-way hashes, never as plain text.
- Signing in creates a signed session that expires. Changing a hub password signs everyone out.
- Repeated wrong passwords are slowed down to block guessing.
- Hubs are not listed anywhere and are hidden from search engines.
The logins vault
- Passwords in the vault are encrypted with AES-256 before they are saved, using a key kept separate from the database.
- They are never sent to your browser until someone signed in to your hub presses Reveal, and they hide again after 30 seconds.
- Please share only what I need for the project, and never bank, payroll, or personal financial logins.
- When a project ends, remove or change any shared passwords. I will remind you.
Everywhere else
- The whole site runs over HTTPS.
- The database is not reachable from the public internet except through narrow, checked functions.
- Public forms have rate limits and spam protection.
- Only I have admin access.
Found a problem?
If you think you have found a security issue, email me right away. I will respond quickly and keep you updated.
Questions
Email justin@workshopswithjustin.com. I read every message myself.