Security & Data Protection
Security matters — even though this is still a very small one-person project built in Cairo. Here’s what I currently do to keep your data reasonably safe, and what I plan to improve as we grow.
Authentication
Supabase Auth with secure password hashing, rate limiting on login attempts, refresh token rotation, and session invalidation on password change.
Row Level Security (RLS)
Every table enforces RLS policies. Users can only read/write data that belongs to their company/tenant — enforced at the database level.
Encryption in Transit
All traffic uses TLS 1.3 (modern browsers enforce this). Supabase edge + CDN also enforce HTTPS.
File Storage Security
Supabase Storage with private buckets by default, signed temporary URLs for downloads, file size & type restrictions, no public URLs.
Access & Activity Logging
Basic audit trail for important actions (login, password change, role changes, file uploads). Logs are stored securely and retained for troubleshooting.
Current limitations
No formal SOC 2 / ISO 27001 yet, no external penetration tests, no bug bounty program, single developer — human error remains the biggest risk at this stage.
- Short-term (next 1–3 months)
Enable 2FA / passkeys
Already supported by Supabase — will make mandatory for admin/manager roles first.
- Medium-term (3–12 months)
External security audit / pentest
Once we have paying customers and meaningful usage.
Better monitoring & alerting
Failed logins, suspicious IP patterns, large file uploads, unusual query patterns.
- Long-term / when enterprise-ready
Public bug bounty program
Reward ethical hackers for finding real issues.
SOC 2 Type 1 / Type 2
Only when we have enterprise interest and budget to justify the cost.
If you discover any vulnerability — even something small — please report it responsibly. I take every report seriously and will respond quickly.
Please do NOT post vulnerabilities publicly until I’ve had a reasonable time to fix them. Thank you for helping keep this safe.
This page is intentionally straightforward because the product is still very early. Security practices will become more formal (and more documented) as we grow and take on paying customers.
Thanks for caring about security — it matters to me too.