Security

Last updated: 17 September 2026

Challenge code is treated as hostile. It does not run against the Supabase control-plane database. Each run gets a throwaway Postgres schema with statement and lock timeouts, a SQL statement guard, and a temporary Python workspace. The schema is dropped after hidden tests write the score.

• Row Level Security is on and forced for tenant tables. Default deny. Clients cannot read ciphertext.
• Provider keys are encrypted with AES-256-GCM. Decrypt happens with a server-only key via the service role. Browser and authenticated RPCs never return the box.
• Publishable Supabase keys only in the browser. Secret key and ENCRYPTION_KEY stay server-side.
• Auth uses email/password sessions. Capability checks use memberships, not profile role claims.
• Security headers: CSP, frame deny, nosniff, referrer policy, HSTS in production.
• In-app rate limits on auth and APIs. Unsigned product APIs return 401.

We do not claim SOC 2, ISO 27001, or any certification. The product is designed so those programs can be added later.