Security model
OBRYX uses a tenant-isolated workspace model. Supabase Auth identifies users, Postgres RLS scopes organization data, and private Storage buckets hold sensitive files.
Client-side navigation is never the authorization boundary.
Baseline controls
Required controls include RLS tests, private buckets, service-role isolation, security headers, audit logs, webhook signature verification and least-privilege environment variables.
No service role, Stripe secret, webhook secret or private API key may ship to browser or mobile bundles.
Legal acceptance records, billing events, invitation changes and permission changes should be retained in tamper-resistant audit logs.
Incident response
Security incidents must be triaged by severity, preserve logs, limit access, notify affected customers according to approved policy and document remediation.
A public vulnerability disclosure route should be approved before broad launch.
Known launch blockers
Unresolved Supabase migration drift, critical RLS findings, leaked secrets, unverified webhook signatures or untested app-store builds block official launch.