Security

Current Security Boundary

• Supabase verifies identity
• the API decides authorization
• tenant IDs come from the URL path and server-side claims
• admin email domains are enforced server-side
• webhook signatures are verified before processing
• OAuth tokens are encrypted at rest

Important Invariants

1. UI route guards are not security boundaries.
2. Tenant-scoped queries must filter by tenant.
3. Reward and wallet updates must stay transactional.
4. Admin actions must be audited.
5. Provider secrets must never be logged.