Security
Built to keep every customer’s work separate, evidenced, and approved
SpectoSite is under active development. This page is deliberately honest about what is live today versus what is still being built — we do not claim unfinished functionality is already available.
Row-Level Security on every tenant table
13 multi-tenant tables, RLS enabled on all of them, verified with a transactional test suite (18/18 assertions passing) covering same-user access, cross-tenant denial, self-role-escalation blocking, self-workspace-add blocking, anonymous denial, and service-only table write denial.
No first-user-wins owner assignment
The owner role is never assigned automatically. It is configured through a server-side identity, set deliberately by Ged.
Search-path–pinned, minimally-executable database functions
Every RLS helper function has a fixed search_path and no anonymous execute grant, closing the two classes of issue Supabase's own security advisor checks for.
Owner-managed public portfolio, tenant-isolated by design
Anonymous visitors can read only published portfolio entries; all writes require an owner/admin role, enforced at the database level, not just in the UI.
Email/password and passkey authentication
Supabase Auth integration for account creation and sign-in.
TOTP multi-factor authentication
Required for the admin area and for sensitive actions.
AAL2-gated admin & sensitive actions
Fresh MFA required for provider-key changes, integration changes, production deployment, user administration, and destructive operations.
Encrypted, envelope-secured provider credentials
Builder and reviewer API keys, encrypted server-side, never returned in plaintext after submission.
Private outbound-polling build worker
The Control Centre worker polls SpectoSite over authenticated HTTPS — no inbound port is ever opened on the build machine.
Independent, genuine security review before production-domain attachment
A dedicated adversarial review pass before www.spectosite.com goes live.