Skip to content
ScanPick ScanPick Docs

Security

ScanPick is designed for on-premise deployment where the operator controls the infrastructure, network, and database. Security is focused on practical warehouse operations.

Authentication

Section titled “Authentication”

Worker Auth

Section titled “Worker Auth”

Workers authenticate with a Worker ID and 4-digit PIN:

  • PINs are hashed with BCrypt (cost factor 12) before storage
  • The API issues JWTs with 24-48 hour expiry
  • No refresh tokens in v1 (expired tokens require re-authentication)
  • No email, no password, no IT involvement

Manager Auth

Section titled “Manager Auth”

Managers and admins use the same PIN-based authentication as workers, but the web dashboard checks the user’s role before allowing access.

JWT Security

Section titled “JWT Security”
  • The JWT_SECRET must be at least 64 random characters
  • The secret is known only to the ScanPick API instance
  • Tokens are issued per-login; invalidating all active tokens requires changing the JWT_SECRET and restarting the API

Network Security

Section titled “Network Security”
  • ScanPick does not require internet access to operate
  • The only outbound contact is periodic license validation against the Keygen API (can be disabled with certain license tiers)
  • All communication between components (API ↔ mobile, API ↔ dashboard) stays on your LAN unless you expose it
  • For production, run behind a reverse proxy with TLS encryption
  • No telemetry, no usage statistics, no phone-home

Database Security

Section titled “Database Security”
  • PostgreSQL credentials are set via environment variables
  • Use a dedicated database user (not the postgres superuser)
  • Enable SSL for database connections over untrusted networks
  • Regular backups are your responsibility

Data Isolation

Section titled “Data Isolation”
  • Each ScanPick instance is single-tenant — your data stays in your database
  • No shared infrastructure, no multi-tenancy
  • License keys are validated per-instance, not per-user

Physical Security

Section titled “Physical Security”

Since ScanPick runs on your hardware:

  • Lock down the server physically
  • Use OS-level firewalls
  • Keep the host OS updated
  • Monitor SSH access logs

Incident Response

Section titled “Incident Response”

If you suspect a security issue:

  1. Change the JWT_SECRET and restart the API (invalidates all tokens)
  2. Change all worker PINs
  3. Review database access logs
  4. Open a security issue