waitrooms.dev
Get Waitrooms
Security

Security at Waitrooms

The specific measures that protect your account, your visitors and your site.

Your site stays up

  • If Waitrooms can't be reached, the snippet opens your page after a short timeout. We're designed never to be the cause of an outage.
  • Visitors already let in hold passes that verify offline, against public keys, without contacting us.
  • Each room chooses what happens if our queue store is unreachable: let new visitors in, or hold them.

Passes and line integrity

  • Passes are ES256-signed tokens; only Waitrooms can issue them, and anyone can verify them.
  • Places in line are HMAC-signed, so they can't be forged or moved forward.
  • A place in line can only be redeemed a few times, so sharing it doesn't let a crowd in behind one person.
  • An emergency control revokes every issued pass within seconds.
  • Visitors are only ever redirected back to the room's own site, never to an address in the URL.
  • Optional invisible bot checks (Cloudflare Turnstile) run before a visitor gets a place.

Accounts and keys

  • Passwords are stored as salted PBKDF2-SHA256 hashes. API keys, session tokens, invites, reset links and VIP links are stored only as SHA-256 hashes; the full value is shown once.
  • Sessions use HttpOnly, SameSite cookies, and changes from the browser are only accepted from our own origin.
  • Four roles (owner, admin, developer, viewer) control who can change what. Workspaces are isolated in every query.
  • Sign-in, join and API traffic are rate limited at the edge.

Custom pages

Customer-written HTML runs in a sandboxed frame with scripts disabled and a strict content security policy, so a waiting page can't run code against visitors or our dashboard. Uploads are limited to raster image types; SVG isn't accepted.

Infrastructure

Waitrooms runs on Cloudflare's network, with data in Neon (Postgres) and Upstash (Redis), all encrypted in transit and at rest. Webhooks are signed with a per-endpoint secret and protected against replay.

Reporting a vulnerability

Please email hello@waitrooms.dev with details. We'll acknowledge within two working days, and ask that you give us reasonable time to fix the issue before disclosing it.