Security overview

A technical summary for security reviewers.

Architecture

• Next.js on Vercel; Supabase (Postgres, Auth, Storage, Realtime).
• All traffic over HTTPS with HSTS; strict Content-Security-Policy, frame-ancestors none, no-sniff and a restrictive Permissions-Policy.
• The service-role key is used only in server code after an explicit authentication and role check.

Data protection

• Row-level security on every table; org IDs are immutable on every row (enforced by trigger).
• Evidence, vault files and exports are kept in private storage with per-workspace paths (profile photos are public); the legal vault also requires a two-factor-verified session.
• Third-party secrets (KRA eTIMS keys, calendar tokens) are encrypted with AES-256-GCM before storage and never sent to browsers.
• Spreadsheet exports neutralize formula injection.

Application security

• Input validation with zod on every API route; mass-assignment guards; rate limiting on authentication, payment and export routes.
• Webhook verification: GitHub HMAC-SHA256, IntaSend challenge plus server-side status re-fetch.
• Open-redirect protection on all post-login redirects.

Reporting a vulnerability

Contact the OrbitOS team with details and steps to reproduce. Please give us reasonable time to fix before disclosure.