Security baseline

Use least privilege. Route visibility is not authorization: rely on Supabase Auth, RLS, narrow RPC grants, and Edge Function authorization. Browser code must not contain service-role credentials.

Before changing data access, storage, a SECURITY DEFINER function, an Edge Function, or an external webhook:

1. Trace caller, data scope, and authorization mechanism.
2. Validate locally with applicable security/tenant tests.
3. Have security-sensitive changes independently reviewed.
4. Treat suspected cross-sponsor access, private-media exposure, token exposure, or webhook forgery as an incident.

The detailed security inventories are restricted operational material. They should be reviewed from the repository by authorized engineers, not copied into public-facing documents.

Purpose and scope

This baseline covers application code, Supabase policies/RPCs/functions, storage, webhooks, and deployment configuration. It summarizes source-backed controls at e06690c; it does not certify current production configuration or replace a security review.

Required review workflow

1. Identify caller, data classification, resource scope, authorization decision, and external side effects.
2. For UI changes, verify server/RLS enforcement remains correct; never rely on ProtectedRoute or hidden navigation.
3. For database changes, inspect RLS, grants, SECURITY DEFINER search paths, migrations, and tenant-isolation tests.
4. For Edge Functions, ensure bearer/capability/webhook authorization is explicit before service-role use and update authorization-test inventory when the repository requires it.
5. For storage, verify bucket/object policy and signed URL semantics; private pending media must not become public by convenience.
6. Run applicable checks and obtain independent review for sensitive boundaries. Record limitations separately from passes.

Stop conditions

Escalate suspected cross-sponsor reads/writes, raw participant-contact exposure, client-side privileged credentials, anonymous mutation capability, missing webhook verification, insecure direct object access, missing RLS, or an unreviewed SECURITY DEFINER grant/path. An observed exposure follows incident response.