Security Readiness Checklist
Security backbone
We treat safety like a product feature, not a marketing line. This page is a public ledger of what is live, what is paid-and-paused, and what is still scaffolded.
Hardening
- Strict CSP, HSTS, X-Frame-Options, Referrer-Policy, Permissions-PolicyshippedEdge middleware sets the headers on every response.
- RLS on every public table (default deny)shippedEach migration adds RLS + policies; no service-role calls from the browser.
- Audit log of sensitive actionsshippedPosts, reports, payouts, automations, miniapp SDK calls and grants are recorded in app_audit_log.
- Crisis pipeline (panic button + keyword hint)shippedLocal resources + anonymous server-side log; surfaces help without storing PII.
- Free moderation tier (OpenAI Moderation + nsfw.js scaffolded)shippedServer route /api/moderation/check; image scan ready to enable when budget allows.
- Web Push with VAPID keysshippedService worker handles push + notification clicks.
Paid scaffolds (activate at scale)
- AWS Rekognition image moderationscaffoldedDrop-in env vars + worker — switch on when balance allows.
- PhotoDNA / NCMEC reporting (CSAM)scaffoldedcsam_report table + queue exist; reporting pipeline pending vendor approval.
- ClamAV file scan on uploadscaffoldedVault accepts uploads; scanning hook ships with paid tier.
- Sentry error monitoringin progressShim in place — flip env var to start streaming.
- Cloudflare Turnstile on auth + reportsscaffoldedForm fields ready, env-gated to enable.
Continuous testing
- Penetration-test checklistin progressOWASP ASVS L2 mapping in /security/pentest.
- Bug bounty programshippedPublic scope + safe-harbour terms at /security/bug-bounty.
- Disclosure inboxshippedsecurity@futureassistants.example — PGP key pinned on bug-bounty page.
- Quarterly RLS auditscaffoldedScript under /scripts/audit-rls.ts (todo) compares Postgres policies to spec.