Security

Supabase authentication and row-level security protect reads. Security-sensitive writes pass through authenticated server routes with organisation and role checks. Public share and invitation tokens are random, stored only as hashes, and expire or can be revoked.

The scanner rejects raw IPs, internal hostnames, private and reserved address ranges, and non-approved ports. It pins each TLS connection to the validated DNS answer while retaining the hostname for SNI. Worker authentication and bounded concurrency are required in production.

If you find a vulnerability, avoid accessing data that is not yours and report the minimum evidence needed through the support or security contact published for the deployment. Do not include secrets or personal data in an initial report.