Security

Report a vulnerability

Use GitHub Security Advisories on this repository. Do not open a public issue for a leak of gated documents, an auth bypass, or an open redirect.

Admin APIs authenticate the browser session, then use the service-role key. The service-role JWT is not the actor.
email_confirmed_at is required before any auto-approve.
Internal-domain checks compare the parsed hostname, not a string suffix.
next is same-origin only (src/lib/next-path.ts).
NDA evidence is append-only. Access decisions do not read a mutable NDA row.
HTML decks and PDFs are not in public/. Byte routes stamp the viewer.
Public JS chunks must not contain gated sentinels (scripts/check-public-chunks.ts).
RLS is on. anon / authenticated are revoked on investor tables.

Never commit .env.local. Rotate SUPABASE_SERVICE_ROLE_KEY and CRON_SECRET if they appear in a log or a screenshot.