Access
Auth and isolated workspaces
Security
Security and data protection
Technical and operational controls to reduce data leakage, abuse, and data loss risk.
Abuse
Rate limits by IP and user
Resilience
Planned export and recovery
1. Data isolation
Every operational query must filter by user or workspace. Relational tables should keep foreign keys, RLS/policies in Supabase, and server-side mutation validation.
2. Abuse controls
- Rate limits on auth, receipt reading, feedback, and sensitive endpoints.
- Origin validation in public and private server actions.
- Error messages without leaking internals or enabling account enumeration.
3. Data loss and recovery
The product should support export, operational backups, and consistency audits. Before database changes, migrations must be tested in staging with planned rollback.
4. What you can do
- Use a strong and unique password.
- Review devices and sessions when the auth provider makes that available.
- Export your data periodically if the system becomes your main source of truth.