Verified identity
Supabase Auth stores and verifies passwords. Server authorization uses verified claims, not a browser-provided session object.
Security by boundary
Customer context is resolved on the server.
The interface is not the security boundary. Authentication, system roles, memberships, tenant context, record scoping, and support access are enforced behind it.
Tenant-scoped data
Customer-owned queries include the server-resolved tenant ID. Database RLS is enabled as deny-by-default defense in depth.
Visible support access
A persistent banner identifies the company and real administrator throughout every support-view screen.
Short-lived sessions
Support view expires after 30 minutes, is backed by a hashed opaque token, and can be revoked immediately.
No provider secrets
Integration tokens are not stored in this release. Provider OAuth remains inactive until encrypted storage is designed.
Auditable events
Keyword changes and support-view start/exit events record safe metadata without passwords, tokens, or sensitive payloads.
Security is an ongoing operational responsibility.
Before production launch, Growing Lemon must review the CSP, database roles, RLS exposure, backups, Supabase redirect configuration, SMTP, rate limits, dependency findings, retention procedures, incident response, and administrator bootstrap process.