Security posture

The most recent full security re-scan returned zero findingsacross all scanners (Supabase, dependencies, code).

Full report: security-rescan-report-v2.md.

• RLS enabled on every public table; user roles in a dedicated user_roles table.
• Server functions gate writes with requireSupabaseAuth + role check; supabaseAdmin is loaded inside handlers only.
• Cloudflare Turnstile on sign-in and sign-up.
• Worker requests HMAC-signed with replay-nonce protection.
• SSRF guard on Edge Scan (private-range block, manual redirect handling).