Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Launch TacTile›Foundations›Security & Secrets·29 in this wave

Approve: Security & SecretsTo do · blocker NEEDS MATTHEW: audit every SECURITY DEFINER function for the PUBLIC execute grantTo do · blocker DO NOT RUN: the armed Stripe live-webhook rotation script would leave prod rejecting every webhookBlocked · blocker Per-account rate limiting on write endpointsDone Rate limit auth endpointsDone Agent-run pre-launch security auditDone Rotate all credentials at production cut-overTo do Encrypt card connector tokens — currently plaintextTo do Make the cookie banner actually gate non-essential storageDone NEEDS MATTHEW NOW: anon can delete any account — one REVOKE closes itDone NEEDS MATTHEW: v_account_tier leaks the full customer roster to anon — confirmed liveDone Add in-product Report link on the public destination viewerBlocked Contact PATCH was wiping every card field — fixed, PR #164Done NEEDS MATTHEW: GitHub Actions billing wall — all CI is blockedDone Apply the October DB hardening batch (F-1 anon public-destinations read + 5 drafted migrations)To do runs.tactile.to is on the open internet behind only an app passwordTo do Enable Supabase leaked-password protectionTo do Publish security.txt (vulnerability disclosure)Done Confirm sandbox flag unset in productionDone Add CORS middleware to tactile-apiDone Add CSP header on web responsesDone Add HSTS headerDone SAST scanning in CIDone Cookie consent bannerDone Audit log table for sensitive opsDone Add abuse-report endpointDone Document secrets inventoryDone Dependency scanning in CIDone Agent-harness escape strings were shipping in page source — stripped, PR #167Done

Wave

Security & Secrets

v1.0 security hardening + secrets discipline. Agent-run security audit before production cut-over (no third-party pen test for v1.0).

TacTile › Launch TacTile › Foundations › Security & Secrets

20/29 done9 open3 open blockers

Selected taskclear

Approve: Security & Secrets

To doOwner · met_0383f11cBlocker

Matthew's final sign-off gate for security.

Waiting on 18 · 4 still openAdd CORS middleware to tactile-api Add CSP header on web responses Add HSTS header SAST scanning in CI Per-account rate limiting on write endpoints Rate limit auth endpoints Cookie consent banner Audit log table for sensitive ops Add abuse-report endpoint Document secrets inventory Dependency scanning in CI Enable Supabase leaked-password protection Publish security.txt (vulnerability disclosure)Confirm sandbox flag unset in production Agent-run pre-launch security audit Rotate all credentials at production cut-over Encrypt card connector tokens — currently plaintext Add in-product Report link on the public destination viewer

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**Approve: Security & Secrets** · to do · blocker

Matthew's final sign-off gate for security.

Where it sits: TacTile › Launch TacTile › Foundations › Security & Secrets

## Waiting on 18

- Add CORS middleware to tactile-api — done
- Add CSP header on web responses — done
- Add HSTS header — done
- SAST scanning in CI — done
- Per-account rate limiting on write endpoints — done
- Rate limit auth endpoints — done
- Cookie consent banner — done
- Audit log table for sensitive ops — done
- Add abuse-report endpoint — done
- Document secrets inventory — done
- Dependency scanning in CI — done
- Enable Supabase leaked-password protection — to do
- Publish security.txt (vulnerability disclosure) — done
- Confirm sandbox flag unset in production — done
- Agent-run pre-launch security audit — done
- Rotate all credentials at production cut-over — to do
- Encrypt card connector tokens — currently plaintext — to do
- Add in-product Report link on the public destination viewer — blocked

4 of those are still open. If one genuinely blocks this, say so and stop rather than working around it.

## The brief on file

[2026-10-16 · Viv] Wording fix only; your click and every recommendation on this block are unchanged. Where the 15 Oct block says Viv "rebases #655", read "cuts a replacement PR off main after #711 and #681 land" (a rebase is a force-push; see t_b3995b85, 16 Oct). Where it says Viv "readies Vault PR #735", read "#735 merges in the deploy sitting after MERGE-QUEUE step 8, not the first t_a050ee07 sitting" (see t_c82554db, 16 Oct). Neither changes what approving does.

[2026-10-15 · Viv] WAITING ON MATTHEW — supersedes the 8 Oct block below (counts and launch edges corrected; every fact re-checked 15 Oct, prod read with SELECT only)
DECISION: Approve Security & Secrets now (it holds 82 open tasks, 27 of them Kaitlynn's), accepting for v1.0 that CSP stays report-only (script-src still allows unsafe-inline and unsafe-eval), the customer apps stay on Next 14.2.35 (no patched 14.x line exists), and leaked-password protection stays off while the org is on Free?
RECOMMEND: Yes, with five named follow-ups that stay open and keep the launch task blocked: F-1 (t_a70b73b9), the card-token Vault (t_c82554db), the Report link (t_b3995b85), the support@ test (t_500d6202) and runs.tactile.to behind Access (t_c9d4fcf7). Evidence: the audit addendum (draft PR https://github.com/TacTile-dev/TacTile/pull/734, docs only) finds no advisory reachable on the customer apps beyond DoS-class, 3 reachable on runs.tactile.to, and F-1 as the one gap that exposes customer content; prod today shows 0 of 82 tables without RLS, 180 policies, nothing applied since 6 Oct, but p_destinations_public_select still live on 14 tables (166 public destinations, 3 Wi-Fi rows with a password column, 4 payment rows readable with the anon key), 0 card-token rows, and CSP report-only on tactile.to and app.tactile-connect.com. Approving does not say any of the five is done.
IF YES, NEXT: You click approve (30 seconds), then email support@tactile-connect.com from your phone and reply "arrived" or "missing" plus who watches it (2 min, t_500d6202). Viv, no prod, same day: wires t_c82554db, t_b3995b85 and rotation t_6334eae3 straight to the launch task t_50635664 (this gate is their only dependent, so approving would drop them off the launch path; F-1 and runs already hold it); files the addendum's F1 (reject the Next-Action header, 45 min, holds launch) and F2-F9 on launch prep, plus a post-launch Next 15 task; rebases #655, which conflicts (your part later: read report-page.ts:180-199, merge, deploy web, about 15 min); readies Vault PR #735 (Workers first, then your named yes on a one-file apply, about 5 min); records the report-only and leaked-password gaps on t_e4976e10 and t_8cd71e61 (the latter also gates Approve: Auth).
COST IF YES: About 3 minutes now, $0. The five stay open on prod until their own named yes: about an hour of yours across them (the F-1 batch is PRODUCTION with one IRREVERSIBLE migration, runs Access about 5 min), after the profiles deploy t_a050ee07 (blocked on you; prod is still on 938b9a6c). Not closed by this click: credential rotation, still red in nightly verify (16 critical rows, oldest 125 days, plus 7 placeholders; main run 38748098474, 15 Oct). The leaked service_role key stays live until you rotate at launch prep (t_3e28c5b5, re-surfaces 5 Nov; key-migration PR #671 conflicts with main); legacy keys retire at the end of 2026.
COST IF NO: 82 open tasks stay held, 27 of them Kaitlynn's, 54 days from launch (Tue 8 Dec); apply-then-approve would park them behind the deploy sitting (6 days late already) and all five follow-ups, and none of the five needs this click to proceed.
SAFE TO ASSUME: Viv never marks this gate done and writes nothing to prod; agents build drafts only. Leaked-password protection rides the 5 Nov Pro-at-launch task I proposed on t_a2ccb527 (filed when you say close there): your 6 Oct call covers pre-launch only, and buying Pro on 8 Dec is not decided either way. No Turnstile on the Report form for v1.0 unless you say otherwise on t_b3995b85. The broken `pnpm secrets:rotate Stripe live_webhook_secret` never runs (t_90e27a65). Your click approves none of: the Report copy, the runs.tactile.to change, any production apply; each keeps its own named yes.

EVIDENCE (read 15 Oct evening PT; not part of the block)
- PRs: #734, #735, #732 open drafts, MERGEABLE; #655 CONFLICTING/DIRTY; #671 CONFLICTING/DIRTY. CI on #734 and #735: only failing step is "Secrets rotation audit" (runs 37888433708, 37888440161), playwright cancelled, semgrep, dep-scan and static-firewall green. origin/main still 4f2c1d6b (6 Oct).
- Audit: docs/audit/2026-10-08-prelaunch-audit-addendum.md on r30/security-audit, sections 1.3 (110 advisories: 95 no, 9 probably no, 1 post-auth, 2 unknown, 3 reachable on runs.tactile.to), 4.2 (F-1), 5.1 (Decisions 1-3), 5.3 (known gaps).
- Vault: #735 head 3aaec969, migration 202610082330 DRAFT, NOT APPLIED; card_connector_accounts 0 rows, vault.secrets 0 rows.
- Prod probes: api.tactile.to/api/health version 938b9a6c; runs.tactile.to/health answers 200 unauthenticated; last migration 20261006190341; next@14.2.35 in apps/web, web-mobile, context-dashboard (package.json on origin/main), no Next-Action guard in middleware yet.
- Graph: this gate's open prerequisites are t_8cd71e61, t_6334eae3, t_c82554db, t_b3995b85, t_500d6202; its dependents are t_50635664 (launch), Approve: Backend API, Approve: MCP surface, t_dc0198ae. Precedent for approving with open prerequisites: t_261c7775 (6 Aug).

[2026-10-08 · Viv] WAITING ON MATTHEW — supersedes any earlier block below
DECISION: Approve Security & Secrets now, with F-1, the card-token Vault, the Report link and the support@ test as named follow-ups, and CSP staying report-only for v1.0?
RECOMMEND: Yes: tonight's audit addendum (https://github.com/TacTile-dev/TacTile/pull/734) finds the only 3 reachable dependency advisories sit on runs.tactile.to, not the customer apps, and F-1 is the only gap that lets anyone with the public anon key read customer content (public destinations, incl. 3 Wi-Fi password rows and 4 payment rows); it now has its own task, which blocks launch, and the client sweep found no first-party app that breaks when it closes.
IF YES, NEXT: You click approve, then email support@tactile-connect.com from your phone and reply "arrived" or "missing" plus who watches it (2 min, t_500d6202). Viv: readies the Vault PR https://github.com/TacTile-dev/TacTile/pull/735 (draft migration, Workers first, then your named yes on a 5-minute apply); rebases #655, which conflicts, so the Report link stops 404ing (later you read 20 lines of copy and merge, about 15 min); moves rotation t_6334eae3 to launch prep; relabels CSP as report-only.
COST IF YES: About 3 minutes now, $0. F-1 stays open until its task is done; prod holds 0 card-token rows, so the Vault gap exposes nothing yet.
COST IF NO: 80 open tasks downstream, 26 of them Kaitlynn's.
SAFE TO ASSUME: Leaked-password protection (t_8cd71e61) is parked as an accepted gap: it needs Supabase Pro, which your 6 Oct no-Pro call already settled. No Turnstile on the Report form for v1.0. Customer apps stay on Next 14.2.35 for v1.0 (no patched 14.x exists) and Viv files a post-launch upgrade task. The Stripe live-webhook rotation never runs. Agents build drafts only, no prod writes.

Viv — compile the finished Security & Secrets package for review; surface anything needing Matthew's sign-off.

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

Security & Secrets

Approve: Security & Secrets