- Customer names, phone numbers, notes, and appointment records
- Booking and session tokens
- Password hashes
- Supabase project identifiers and credentials
- Administrator and operations screenshots
- SQL exports, logs, and backups
- Private source code
- Server-only secret handling
- Explicit administrator role provisioning
- Supabase Auth verification on admin actions
- Zod input validation
- bcrypt password hashing
- Random customer sessions stored as HMAC hashes
HttpOnly,SameSite=Lax, secure production cookies- Row Level Security on application tables
- Application availability checks plus transactional database enforcement
- Repository secret scanning and dependency audit in the release checklist
Distributed rate limiting, bot controls, bearer-link lifecycle, isolated RLS integration tests, retention policy, backup drills, and incident ownership remain to be completed or TO CONFIRM WITH MOAD.