Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Launch TacTile›Foundations›Security & Secrets·26 in this wave

Approve: Security & SecretsTo do · blocker NEEDS MATTHEW: audit every SECURITY DEFINER function for the PUBLIC execute grantTo do · blocker Per-account rate limiting on write endpointsDone Rate limit auth endpointsDone Agent-run pre-launch security auditTo do Rotate all credentials at production cut-overTo do Encrypt card connector tokens — currently plaintextTo do Make the cookie banner actually gate non-essential storageDone NEEDS MATTHEW NOW: anon can delete any account — one REVOKE closes itDone NEEDS MATTHEW: v_account_tier leaks the full customer roster to anon — confirmed liveDone Add in-product Report link on the public destination viewerTo do Contact PATCH was wiping every card field — fixed, PR #164Done NEEDS MATTHEW: GitHub Actions billing wall — all CI is blockedDone Enable Supabase leaked-password protectionTo do Publish security.txt (vulnerability disclosure)Done Confirm sandbox flag unset in productionDone Add CORS middleware to tactile-apiDone Add CSP header on web responsesDone Add HSTS headerDone SAST scanning in CIDone Cookie consent bannerDone Audit log table for sensitive opsDone Add abuse-report endpointDone Document secrets inventoryTo do Dependency scanning in CIDone Agent-harness escape strings were shipping in page source — stripped, PR #167Done

Wave

Security & Secrets

v1.0 security hardening + secrets discipline. Agent-run security audit before production cut-over (no third-party pen test for v1.0).

TacTile › Launch TacTile › Foundations › Security & Secrets

18/26 done8 open2 open blockers

Selected taskclear

Contact PATCH was wiping every card field — fixed, PR #164

DoneOwner · ait_02a55c44

Live production data loss: every PATCH to /api/contact deleted all contact_card_fields rows. Two distinct instances found and fixed.

No dependencies in this wave — nothing gates it, and nothing waits on it.

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**Contact PATCH was wiping every card field — fixed, PR #164** · done

Live production data loss: every PATCH to /api/contact deleted all contact_card_fields rows. Two distinct instances found and fixed.

Where it sits: TacTile › Launch TacTile › Foundations › Security & Secrets

## The brief on file

CORRECTION 2026-08-02 — this task is genuinely DONE, but one line in its notes is wrong and will actively mislead the next agent. Fixing the record.

WHAT THIS TASK ACTUALLY FIXED (PR #164, correct): the GATE on contact.ts's wipe-and-reinsert block. Before 2026-07-29 the condition could never be false, so every PATCH — including a metadata-only one — deleted every contact_card_field. Now the block is skipped when `fields` is absent. That fix is real and still in place; see the comment at contact.ts:745-750.

THE WRONG LINE: this task's sweep recorded "menu.ts:474 / link_hub.ts:277 — safe." Both were re-read on 2026-08-02 and NEITHER is safe. They are the same delete-then-insert shape:

  - link_hub.ts DELETEd every link then INSERTed replacements. PROVEN destructive and fixed on PR #189 — four tests pin the new ordering, validated by restoring the old ordering and confirming exactly those four fail.
  - menu.ts:511-514 DELETEs every section (CASCADE takes items, variations, modifier groups) then rebuilds in a loop with FIVE 500-exits. The code's own comment at :520-524 admits it leaves a partially-rebuilt menu. Now tracked as t_cfda0be6.

AND contact.ts ITSELF IS STILL EXPOSED, which this task's "done" status obscures. The gate was fixed; the ORDERING inside the block was not. When `fields` IS sent it still deletes before inserting, and iOS sends the complete array on every PATCH (ContactActionContent.swift:411), so the destructive path runs on every iOS contact save. Now tracked as t_e2b4d704.

WHY THE SWEEP MISSED IT: a gate audit asks "can this run when it shouldn't?" It does not ask "when it does run, is the order survivable?" Both questions are needed, and only the first was asked. Worth remembering the next time a route is declared clean.

No action needed on THIS task — it did what it says. The two follow-ups are tracked separately.

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

Security & Secrets

Contact PATCH was wiping every card field — fixed, PR #164