We'd rather build securely.
A little less “move fast and break production”.
Access control
Project workspaces use Supabase Row Level Security. Sensitive project data is limited to the project owner and accepted members. Sensitive server actions use server-side authorization.
Data protection
Secrets intended for server use are kept out of client-side code. Database-level constraints limit input sizes and permitted values. The application adds security headers and disables framework fingerprinting where supported.
Abuse resistance
Sensitive privacy operations are rate-limited. The database is the final enforcement layer for project access; hiding buttons in the UI is not treated as authorization.
Responsible disclosure
Please report suspected vulnerabilities privately rather than exploiting them or exposing user data. Security reports: arturnegru@gmail.com.
Incident response
Security incidents are assessed, contained, investigated and documented. Personal-data incidents follow the applicable breach-notification requirements.