Tenant isolation
Workspace data is protected by role checks, row-level database policies, and service boundaries that re-verify the signed user.
Security
Secrets stay server-side. Workspace access stays scoped.
The application is designed around least privilege, verified service boundaries, tenant isolation, and safe failure behavior. Production configuration is treated as a launch gate, not an assumption.
Credential containment
Provider credentials live in a server-side encrypted vault. The Next.js app has no service-role client and browsers never receive provider secrets.
Verified webhooks
Meta payloads are byte-limited and signature-verified before parsing. Stripe events use raw-body verification, replay tolerance, durable queues, and authoritative state retrieval.
Recovery safety
Recovery uses verified signed claims plus a short-lived, session-bound, single-use intent. Password changes independently verify the current password.
Auditable operations
Exports, contact redaction, workspace maintenance, team administration, retries, and platform configuration preserve safe audit history.
Secure defaults
Checkout, automatic tax, and commercial limit enforcement remain off until explicit live validation and approval.
Responsible disclosure
Do not access data that is not yours, disrupt service, or publish an unverified issue. Include reproduction steps and impact, but never include live credentials or unrelated customer data. Send security reports to stonergoldfish84@gmail.com.