Board links
- Every board ID is 21 random characters, about 126 bits, so it can't be guessed or worked through. Boards are never listed, and board pages tell search engines not to index them.
- Host and co-host links carry their key after a
#, which browsers never send to servers, and Kanbond removes it from the address bar as soon as the page opens. A host can reset those links at any time, and the old ones stop working at once. - Browsers send page addresses to other sites without the board ID, so links you click on a board don't leak it.
Protecting a board
- Passwords are stored only as a salted PBKDF2-SHA256 hash. Wrong guesses are limited per network and per board. After the right password, your browser keeps a signed access token instead of the password, and changing the password retires every token.
- Waiting room: the host can make everyone wait to be let in, and remove people, who stay out until let in again.
- Host settings make renaming, the bulletin, card contents or moving things view-only for everyone else. The server enforces them, not only the page.
- Nothing is lost by accident: undo, a 7-day trash, a history of every change and a daily backup kept for 7 days mean nobody with the link can wipe a board for good.
Connections
- All traffic, including the live connection to a board, is encrypted with TLS (HTTPS and secure WebSockets).
- Each board runs in its own isolated room on Cloudflare, which checks every change against the board's rules and limits how fast any one connection can send.
- Board creation is protected by Cloudflare Turnstile and a limit per network, to stop automated abuse.
What people post
- Everything people type is shown as text. Markdown is cleaned before display: raw HTML and unsafe links are removed.
- Pictures linked from other sites load only when you click them, or from sites you chose to allow, and without a referrer, so a card can't track who views it.
- Chat files are served from a separate address with a random ID, as downloads unless they're pictures, video or audio, and sandboxed so nothing in them can run.
- The site sends strict security headers: it can't be framed by other sites (no clickjacking), and camera, microphone and screen sharing are allowed for Kanbond only.
Accounts
- Kanbond has no passwords of its own: you sign in with Google or with a one-time link sent to your email.
- Sessions use a secure, first-party cookie. You can sign out on every device at once from the account menu.
- Access to password-protected boards that syncs to your account is sealed with AES-GCM encryption.
Calls
Huddles go directly between browsers and are end-to-end encrypted by WebRTC. Kanbond's servers only help the browsers find each other and never receive the audio or video. A relay, when one is needed, passes on the encrypted stream without being able to read it. AI HuddleMate records only people who choose Allow, and their audio is never stored.
What you can do
- Share a board link only with the people you want on it, and don't post it publicly.
- Add a password or turn on the waiting room for anything sensitive.
- Give out the co-host link rather than the host link, and reset either if it reaches the wrong people.
- Don't keep secrets such as passwords or card numbers on a board.
Report a vulnerability
If you find a security problem, please write to hello@kanbond.com with the steps to reproduce it. We'll reply, keep you posted while we fix it, and credit you if you'd like.
We won't take action against good-faith research that follows these rules: use only boards and accounts you made yourself, don't view or change other people's data, don't overload the service or send spam, and give us a reasonable time to fix the problem before you share it.