Security and reporting a problem
How Little Worker protects your account, what you can do, and how to report a security problem.
Updated
How Little Worker protects your account
- All traffic to the service is encrypted with HTTPS.
- The Mac and iPhone apps keep your sign-in in the Keychain.
- Keys you add for AI providers, and the access Google gives when you connect a Google app, are kept apart from your other data.
- Workers act in the apps you connect and on your Mac only as your Permissions allow.
- Access to data is limited to the people who need it.
No system is perfectly secure. The Security Policy has the full text.
Keep your account safe
- Keep the account you sign in with secure: your Google, Apple, or GitHub account, or your email.
- Turn on two-step verification where Google, Apple, GitHub, or your email service offers it.
- Keep the Little Worker apps, your operating system and your browser up to date.
- Give workers and connected apps only the Permissions they need.
- Replace a key you added if you think it was exposed.
- Disconnect apps you no longer need.
If you think someone used your account
Email security@thelittleworker.com right away.
Report a security problem
Email security@thelittleworker.com. Do not share the problem publicly until Little Worker has had a reasonable time to look into it and fix it.
Include, when you can:
- What the problem is and what harm it could do.
- Where it is: the website, the web app, the Mac app, or the iPhone app, with the version, page, or address.
- Clear steps to reproduce it.
- Screenshots or logs, with any keys and passwords removed.
- How to reach you, and whether you want public credit.
Never put a password, an API key, or a private key in a report.
Little Worker aims to confirm it received a complete report within three business days. Good-faith research that follows the Security Policy is treated as allowed: test only your own accounts and data, and stop if you reach anyone else's.