Findings, not reassurance

• Row-level security on every table, verified by the linter after each migration
• Roles stored in a dedicated table — never on the profile record
• Secrets read only inside server handlers, never shipped to the browser
• Server-side re-validation of every protected mutation
• Audit log for workspace-level administrative actions
• Findings with severity, evidence and a verification state

• Exposed secrets and insecure environment usage
• Missing authentication or weak authorization
• Missing or overly permissive row-level security policies
• Unprotected administrative routes
• Insecure file uploads and unsafe redirects
• Missing input validation and injection risks
• Absent rate limits and sensitive logging
• Dependency vulnerabilities

Send details through the contact page with the affected route, reproduction steps and the impact you observed. We acknowledge reports before triage and never ask for account passwords or session tokens.