Password handling
- TourLedgers uses PBKDF2-SHA256 password hashing with a separate salt for each user.
- The application does not store plain-text passwords.
Security
Protection for artist business data.
TourLedgers uses server-side sessions, protected routes, ownership checks, and Cloudflare storage services to support private artist-business records.
Sessions
- Login sessions use HTTP-only cookies so client-side scripts cannot read the session token.
- Production session cookies use Secure and SameSite=Lax attributes.
Protected access
- Dashboard, account, and administrative routes require an authenticated session before private product information is returned.
- Administrative actions require an approved account with the configured administrative role and identity.
Data storage
- Account and product records are stored in Cloudflare D1.
- Uploaded booking and advance files are stored through the configured Cloudflare R2 asset bucket.
Ownership checks
- Authenticated API routes check account ownership before returning or changing artist records, contacts, shows, pitches, files, and reports.
- Public artist and report links expose only the information intended for those buyer-facing routes.
Responsible disclosure
- Security concerns can be sent to philip@philipstengelpresents.com with the affected route and clear reproduction steps.
- Do not access, alter, retain, or disclose information that does not belong to your account.