Security & trust boundaries

Trust boundaries

• Marketing and /app: public vs authenticated Supabase session.
• BFF (/api/* on web): proxies to API worker with session context.
• API worker: orchestration layer with no direct browser access to secrets.
• GitLab: OAuth scopes limit repo and issue API access.

Publish gate

• Agents produce issue candidates, not live GitLab issues.
• Reviewer must approve in /app before POST publish executes.
• Consensus validation and clustering suppress low-signal worker noise before the review queue sees it.
• PREMORTEM_PUBLISH_DRY_RUN=1 skips remote issue creation in dev.

Provider tokens

• GitLab OAuth tokens stay server-side and are handled through backend storage, not browser bundles.
• GITLAB_TOKEN (PAT) for ingest/publish in server env, never exposed to client.
• Stripe secrets only on server routes and webhooks.

Multi-tenant isolation

• Organizations own projects, audits, and billing accounts.
• API routes scope queries by organizationId from session.
• Supabase RLS migrations provide defense-in-depth for direct DB access.

Repository deep dives

• Session design: docs/security/session-design.md
• Public vs private docs policy: docs/security/public-vs-private-docs.md
• ADR 0001 canonical architecture: docs/architecture/adr-0001-canonical-product-and-system-design.md
• Queue runbook: docs/runbooks/queueing.md

Official documentation