Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Launch TacTile›Foundations›Security & Secrets·26 in this wave

Approve: Security & SecretsTo do · blocker NEEDS MATTHEW: audit every SECURITY DEFINER function for the PUBLIC execute grantTo do · blocker Per-account rate limiting on write endpointsDone Rate limit auth endpointsDone Agent-run pre-launch security auditTo do Rotate all credentials at production cut-overTo do Encrypt card connector tokens — currently plaintextTo do Make the cookie banner actually gate non-essential storageDone NEEDS MATTHEW NOW: anon can delete any account — one REVOKE closes itDone NEEDS MATTHEW: v_account_tier leaks the full customer roster to anon — confirmed liveDone Add in-product Report link on the public destination viewerTo do Contact PATCH was wiping every card field — fixed, PR #164Done NEEDS MATTHEW: GitHub Actions billing wall — all CI is blockedDone Enable Supabase leaked-password protectionTo do Publish security.txt (vulnerability disclosure)Done Confirm sandbox flag unset in productionDone Add CORS middleware to tactile-apiDone Add CSP header on web responsesDone Add HSTS headerDone SAST scanning in CIDone Cookie consent bannerDone Audit log table for sensitive opsDone Add abuse-report endpointDone Document secrets inventoryTo do Dependency scanning in CIDone Agent-harness escape strings were shipping in page source — stripped, PR #167Done

Wave

Security & Secrets

v1.0 security hardening + secrets discipline. Agent-run security audit before production cut-over (no third-party pen test for v1.0).

TacTile › Launch TacTile › Foundations › Security & Secrets

18/26 done8 open2 open blockers

Selected taskclear

Approve: Security & Secrets

To doOwner · met_0383f11cBlocker

Matthew's final sign-off gate for security.

Waiting on 18 · 6 still openAdd CORS middleware to tactile-api Add CSP header on web responses Add HSTS header SAST scanning in CI Per-account rate limiting on write endpoints Rate limit auth endpoints Cookie consent banner Audit log table for sensitive ops Add abuse-report endpoint Document secrets inventory Dependency scanning in CI Enable Supabase leaked-password protection Publish security.txt (vulnerability disclosure)Confirm sandbox flag unset in production Agent-run pre-launch security audit Rotate all credentials at production cut-over Encrypt card connector tokens — currently plaintext Add in-product Report link on the public destination viewer

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**Approve: Security & Secrets** · to do · blocker

Matthew's final sign-off gate for security.

Where it sits: TacTile › Launch TacTile › Foundations › Security & Secrets

## Waiting on 18

- Add CORS middleware to tactile-api — done
- Add CSP header on web responses — done
- Add HSTS header — done
- SAST scanning in CI — done
- Per-account rate limiting on write endpoints — done
- Rate limit auth endpoints — done
- Cookie consent banner — done
- Audit log table for sensitive ops — done
- Add abuse-report endpoint — done
- Document secrets inventory — to do
- Dependency scanning in CI — done
- Enable Supabase leaked-password protection — to do
- Publish security.txt (vulnerability disclosure) — done
- Confirm sandbox flag unset in production — done
- Agent-run pre-launch security audit — to do
- Rotate all credentials at production cut-over — to do
- Encrypt card connector tokens — currently plaintext — to do
- Add in-product Report link on the public destination viewer — to do

6 of those are still open. If one genuinely blocks this, say so and stop rather than working around it.

## The brief on file

Viv — compile the finished Security & Secrets package for review; surface anything needing Matthew's sign-off.

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

Security & Secrets

Approve: Security & Secrets