Pre-Launch App Security Planning

We're building the Mental Bank Ledger app so members can make their nightly deposit on a computer, an iPhone or an Android phone, all under one account. The app is working and in testing. Members record personal entries every night, so keeping their ledgers private is our top priority, and we want to get the security plan right before launch.

The app is a web app (HTML, CSS and JavaScript). Accounts and data are currently stored in Supabase (PostgreSQL with row-level security).

Our plan before launch:
• Encrypt each member's ledger on their own device before it syncs, so the server only ever stores scrambled data, with a recovery key for members who forget their password
• Move accounts and data from the free test service to a self-hosted secure server
• Wrap the app with Capacitor for the Apple App Store and Google Play

What we'd like help with in this session:
1. Is our overall plan sound, and what are the biggest risks we might be missing?
2. Does our approach to on-device encryption and recovery keys make sense for non-technical members?
3. What matters most when self-hosting the server safely?
4. What should a full security review cover, and how should we scope it so a later volunteer project is focused and useful?

What a successful session looks like: We come away with a short list of top priorities, any changes to make before we build the encryption, and a clear scope for a follow-up code review.

Ideal volunteer: Someone with application security or penetration testing experience, ideally with web or mobile apps. Experience with Supabase, PostgreSQL or client-side encryption is a plus.

Organization Mission

It is the mission of HMI to continually explore within ourselves and others, how our subconscious mind can influence our behavior, affect the events of our lives, and empower us to achieve our dreams and goals. Our philosophy is based on the belief that the subconscious mind is a goal machine, dedicated and driven to the fulfillment of a programmed path. Our primary tenet is that all of the events of our lives, including "luck," both good and bad, is a manifestation of the energy that emanates from our subconscious mind. This energy continually strives to fulfill the agenda for which it is programmed. Through research, education, and the clinical application of this tenet, HMI aspires to better the world, by fostering a greater awareness of these principles and the development of one’s subconscious mind to be more congruous with ones conscious desires. HMI School Mission: It is the Mission of HMI’s Hypnotherapy School to: continually strive to provide the highest quality and most up to date training possible that is educationally sound and demonstrably effective; administrate, advertise and operate the school in a manner that meets the spirit and standards of accredited schools and to ensure that standard through ongoing voluntary participation in the accreditation process; recognize students' individual differences to produce competent and satisfied graduates that are prepared for self-employed private practice in hypnotherapy and/or applying hypnotherapy techniques in their existing profession; instill in graduates the motivation to pursue the spirit of service to the community that HMI embodies.