Document 02 — Security

7 Layers of Enterprise Security

Every layer works together to protect your financial data. No single point of failure. Each defense stands on its own — and together, they form an impenetrable shield.

7
Security Layers
21
Protected Pages
12
JS Modules Sanitized
0
Passwords Stored
Defense in Depth

The 7-Layer Shield

Each layer independently prevents a class of attacks. An attacker would need to defeat all seven to compromise data — and that is by design.

1
Google OAuth Authentication
Identity verification delegated to Google
  • No passwords stored in the system — zero risk of password database breach
  • Google verifies identity server-side with industry-leading OAuth 2.0 protocols
  • Session tokens managed by Supabase Auth with automatic expiration and refresh
  • Users sign in with their existing Google account — no new credentials to manage
2
Row Level Security (RLS)
PostgreSQL-enforced data isolation
  • PostgreSQL policies enforced on EVERY table — no exceptions, no bypasses
  • Queries automatically filtered by user's role and organizational scope
  • Feast Builder sees only their feast's data. District Builder sees only their district's feasts.
  • Cannot be bypassed — enforced at the database level, not in application code
3
JWT Authentication
Token-based API request verification
  • Every API request includes a JWT token — no anonymous access to edge functions
  • Edge Functions verify token signature and expiration before processing any request
  • Expired tokens are immediately rejected — no grace period for stale sessions
  • Shared auth module (_shared/auth.ts) for consistent verification across all functions
4
Content Security Policy (CSP)
Browser-enforced resource restrictions
  • Meta tag on every HTML page (21 pages) — comprehensive coverage, no gaps
  • Restricts script sources to trusted domains only — Supabase, Google, PayMongo
  • Blocks inline script injection — even if an attacker modifies the DOM
  • Prevents loading resources from unauthorized origins — fonts, images, and frames included
5
XSS Sanitization
Input/output escaping across all modules
  • escapeHtml() function in sanitize.js — centralized, reusable protection
  • All user-generated content escaped before DOM insertion — names, notes, and descriptions
  • Prevents script injection through data fields — even malicious names cannot execute code
  • Applied across 12 JavaScript modules — consistent sanitization everywhere
6
HMAC Webhook Verification
Cryptographic payment event validation
  • PayMongo webhooks cryptographically signed with HMAC-SHA256 algorithm
  • Server verifies signature before processing — forged requests are rejected instantly
  • Prevents fake payment notifications — no one can spoof a successful payment
  • Webhook secret stored as environment variable — never exposed in client-side code
7
Inactivity Timeout
Automatic session termination after idle period
  • 15-minute idle timer built into app-init.js — consistent across all protected pages
  • Tracks mouse, keyboard, scroll, and touch events to detect genuine activity
  • Automatic session cleanup and redirect to sign-in page upon timeout
  • Prevents unauthorized access from unattended devices — walk away, stay protected
Beyond the 7 Layers

Additional Security Measures

The 7 layers are the core defense. These additional measures provide operational security, accountability, and human-level safeguards.

Audit Logging
The security_logs table records every significant action — sign-ins, role changes, data modifications. Full accountability trail.
Blocked User Prevention
Blocked status is checked on every page load. If a user is revoked, they are immediately locked out — no cached access persists.
Role-Based Approval Chain
New users must be approved by an authorized builder before gaining access. No self-registration — every user is vetted by a human.
Session Verification
Every protected page verifies the active session on load. Invalid or expired sessions are caught before any data is rendered to the browser.