The Standard / Security
The system should fail in contained, recoverable ways.
Access, payments, secrets, and backups each need a clear boundary that can be explained without jargon soup.
I would rather give a client a short, testable security answer than a long list of impressive tools with no operating discipline behind it.
The controls
- Row-level security protects every application table.
- Supabase Auth controls application access.
- Stripe and QuickBooks remain the processors of record, so payments do not touch Watchstander systems.
- HTTPS protects traffic in transit.
- Secrets stay vaulted and never enter the repository.
- Backups and rollback paths are part of the operating plan.
excerpt from a real client artifact, redacted
Security review
Customer table | RLS enabled | Policies tested by role
Payments | Processor-hosted collection | No card data stored
Secrets | Vaulted environment values | Repository scan clean
Recovery | Backup present | Rollback owner named