Server-owned form mutations
Authenticated browsers can read authorised form data but do not directly insert, update, delete or publish source records through a broad database grant. Draft saving, Google connection and publication use server functions that verify the caller and workspace role.
Google provider connections
Form303 verifies a provider token against Google’s user information endpoint and matches the returned Google subject with the identity linked to the authenticated account. Token size is bounded, failures do not create a trusted connection, and connection state is derived on the server.
Provider tokens are encrypted with authenticated encryption rather than stored in plaintext. An expired or revoked connection should produce a clear reconnect action.
Atomic publication
Publication validation covers workspace access, Google connectivity, imported schema, assets and file-upload blockers. A service-role-only database transaction creates a sequential immutable revision and updates the public pointer atomically.
Public forms read the current immutable revision. This prevents an unpublished draft edit from leaking into a live form.
Data isolation
Row-level security restricts workspace forms, assets and responses. Asset references are tenant-scoped, and cross-workspace relationships are rejected. Submission handling applies bounded input and idempotency controls to reduce duplicate responses and resource abuse.
Responsible reporting
To report a security concern, contact brooke@techguider.com.au with reproduction details and avoid accessing data that is not yours.
Current limitations
Form303 does not claim a formal security certification, bug bounty, enterprise SLA or suitability for regulated sensitive data. The service remains in beta and its controls should be evaluated against your own risk requirements.