Security

Authentication

Supabase Auth with email/password, Google, Apple. Password HIBP check rejects leaked passwords.

Authorization

• Roles in a separate user_roles table (never on profiles — prevents privilege escalation)
• Row-Level Security (RLS) on every business table
• SECURITY DEFINER has_role() function avoids recursive policies

Secret encryption

Business secrets (Stripe keys, Twilio creds) encrypted AES-256-GCM (v2). Legacy XOR (v1) auto-migrates on next save.

Signup protection

auth-signup-guard edge function rate-limits per IP to block bot signups.

Email rate limits

Auth emails go through auth-email-hook (Resend) to bypass Supabase's 2/hour limit.