Security Practices

Review ChargeFlow.Pro security practices for account access, protected EV charging data, secure exports, and vulnerability reporting.

Private dashboard access

Vehicle records, charging sessions, analytics, billing actions, CSV exports, and PDF reports require an authenticated account.

Account and session protection

Production web sessions use HttpOnly, Secure, SameSite=Lax cookies. Native iOS API calls use backend-issued bearer sessions, and password reset flows use Supabase Auth email recovery in production.

Export handling

CSV and PDF downloads are account-protected, sent as attachments, marked noindex/no-store, and CSV values are neutralized against spreadsheet formula injection.

Infrastructure controls

The app sends production security headers, rejects unsafe cross-origin API requests, rate-limits sensitive endpoints, verifies StoreKit transactions server-side, and keeps service-role, Apple, payment, and advertising account secrets out of the client.

Account safety

Only sign in at https://chargeflow.pro. ChargeFlow.Pro support will never ask for your password, reset token, Supabase token, Stripe card details outside Stripe, or environment secrets.

Security contact

Report security concerns to support@chargeflow.pro with enough detail for us to reproduce and investigate the issue.