Security model
BagTag uses defense in depth for a multi-tenant youth-sports platform. Controls include encrypted sensitive family fields, keyed lookup values, hashed capability tokens, database uniqueness and transactions, role and tenant authorization, durable rate limits, nonce-based browser policy, audit logs, provider isolation, and non-root production containers.
Access and authentication
Administrative access uses verified staff email and short-lived sign-in capabilities, organization or league membership, and role checks. High-privilege operators should use a protected mailbox and device, least privilege, prompt removal, and any configured step-up controls. Magic links, verification links, sessions, authorization links, and location PINs are bearer secrets.
Data protection
Sensitive family names and emails are encrypted at the application layer. Email matching uses keyed non-reversible indexes. Tokens are stored as hashes. Transport encryption is required in production. Provider credentials and signing keys remain server-side. Logs and analytics are designed to filter direct family identifiers.
Application and infrastructure
- Strict input validation and parameterized database access.
- Tenant guards, permission policies, lifecycle checks, and audit trails.
- Content security policy, framing denial, MIME sniffing protection, restrictive referrer and permissions policy, and HSTS in production.
- Dependency review, test suites, migrations, backups, retention jobs, worker monitoring, and provider health checks.
- Private photo quarantine, signature/size/checksum controls, authenticated moderator preview, publication separation, provider deletion workflows, and a fail-closed production video gate.
Shared responsibility
Leagues and organizations protect accounts, email, devices, exports, PINs, staff membership, public copy, and local processes. Families protect verification and reward links. Partners confirm only live eligible rewards. No security control makes it safe to copy personal information into an unapproved external system.
Report a vulnerability
Send a concise report to support@bagtag.com with the affected URL or component, impact, reproduction steps, and non-sensitive evidence. Do not include real child or family data. We will acknowledge actionable reports, triage severity, coordinate remediation, and request a safe validation when useful.
Safe research boundaries
- Use only accounts, tenants, and test data you own or are authorized to test.
- Do not access, alter, retain, or disclose another person's data.
- Do not perform denial of service, high-volume automation, social engineering, physical attacks, spam, malware, or provider attacks.
- Stop and report immediately if you encounter personal data or can affect a real reward, payment, email, media object, or production availability.
- Give us a reasonable opportunity to remediate before public disclosure.
Incidents
If BagTag confirms a security incident, it will contain and investigate it, preserve evidence, coordinate affected providers and customers, restore safely, and provide legally or contractually required notices without undue delay. Customers must promptly report compromised accounts, exports, links, PINs, or devices.