Security

Pit Lane holds customer and staff information, so security is built in at every step, not added on.

Signing in

• Passwords must be at least 12 characters and can’t contain your username. They are stored only as bcrypt hashes, which can’t be turned back into the password.
• Temporary passwords from an admin must be replaced the first time you sign in.
• After 8 wrong passwords from one internet address, or 16 against one account, within 15 minutes, sign-in is paused.
• After 4 hours without activity you are signed out automatically, with a 3-minute warning first so you can stay signed in. Leaving the screen idle or closing the laptop doesn’t keep you signed in. Your Profile lists every signed-in device, and you can sign any of them out. Admins can sign a person out everywhere or switch the account off.

Who sees what

• Every person has their own private space. Items marked Only me never leave the server for anyone else, admins included.
• Shared lists use roles and Off / View / Edit access levels. The server checks access on every request, not just the screen.
• Every change to a shared list is logged: who, when, which field, old value and new value.

On the wire and in the browser

• All traffic is encrypted with HTTPS.
• The sign-in cookie is HttpOnly, Secure and SameSite, and every change carries a per-session security token, so other sites can’t act as you.
• Pit Lane can’t be framed by other sites, and search engines are told not to index it.
• Your working copy in the browser is wiped when you sign out, so a shared service-drive PC never mixes two people’s data.

On the server

• Each dealership’s Pit Lane has its own database and logins, separate from every other dealership.
• Settings and passwords sit in a folder the web server never serves.
• Up to 30 earlier versions of each area are kept, and the database is backed up every night.
• If two people edit the same record at once, Pit Lane merges the changes instead of overwriting either one.

Report a security concern

If you think you’ve found a weakness, or that someone has accessed information they shouldn’t, email anouar@outthelot.com with “Security” in the subject. We acknowledge reports within [two business days] and keep you updated until it’s resolved.

While investigating, please don’t open other people’s data, change or delete anything, or disrupt the service. Reports made in good faith are welcome.

No system is perfectly secure, and Pit Lane is provided as is and used at your own risk (see the Terms of use). If we learn of a breach affecting a dealership’s data, we tell that dealership without delay, as described in the Privacy policy.