Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Launch TacTile›Foundations›Security & Secrets·26 in this wave

Approve: Security & SecretsTo do · blocker NEEDS MATTHEW: audit every SECURITY DEFINER function for the PUBLIC execute grantTo do · blocker Per-account rate limiting on write endpointsDone Rate limit auth endpointsDone Agent-run pre-launch security auditTo do Rotate all credentials at production cut-overTo do Encrypt card connector tokens — currently plaintextTo do Make the cookie banner actually gate non-essential storageDone NEEDS MATTHEW NOW: anon can delete any account — one REVOKE closes itDone NEEDS MATTHEW: v_account_tier leaks the full customer roster to anon — confirmed liveDone Add in-product Report link on the public destination viewerTo do Contact PATCH was wiping every card field — fixed, PR #164Done NEEDS MATTHEW: GitHub Actions billing wall — all CI is blockedDone Enable Supabase leaked-password protectionTo do Publish security.txt (vulnerability disclosure)Done Confirm sandbox flag unset in productionDone Add CORS middleware to tactile-apiDone Add CSP header on web responsesDone Add HSTS headerDone SAST scanning in CIDone Cookie consent bannerDone Audit log table for sensitive opsDone Add abuse-report endpointDone Document secrets inventoryTo do Dependency scanning in CIDone Agent-harness escape strings were shipping in page source — stripped, PR #167Done

Wave

Security & Secrets

v1.0 security hardening + secrets discipline. Agent-run security audit before production cut-over (no third-party pen test for v1.0).

TacTile › Launch TacTile › Foundations › Security & Secrets

18/26 done8 open2 open blockers

Selected taskclear

NEEDS MATTHEW: audit every SECURITY DEFINER function for the PUBLIC execute grant

To doOwner · met_449fbef0Blocker

A systemic grant bug found while applying the audit-log migration. Several destructive SECURITY DEFINER functions are executable by PUBLIC or by anon in production right now.

No dependencies in this wave — nothing gates it, and nothing waits on it.

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**NEEDS MATTHEW: audit every SECURITY DEFINER function for the PUBLIC execute grant** · to do · blocker

A systemic grant bug found while applying the audit-log migration. Several destructive SECURITY DEFINER functions are executable by PUBLIC or by anon in production right now.

Where it sits: TacTile › Launch TacTile › Foundations › Security & Secrets

## The brief on file

UNBLOCKED 2026-08-09 (round 14). It did NOT need Matthew for the two functions it was blocked on — the premise that they need anon EXECUTE is disproven.

WHAT SHIPPED (PR #312, merged, NOT applied):
  supabase/migrations/202608091400_revoke_public_scan_path_fns.sql
    - revoke log_analytics_event(34 args) + log_open_event(5 args)
      from public, anon, authenticated; grant both to service_role
    - ALTER ... SET search_path = public, pg_temp on the three functions whose
      live proconfig is NULL (cleanup_expired_oauth_codes, log_analytics_event,
      purge_account_analytics)

WHY THE OLD PREMISE WAS WRONG (202607281800:47-49 claimed all three need anon):
  - log_analytics_event has exactly ONE caller,
    apps/api/tactile-api/src/utils/analytics/ingest.ts, and it sends the
    SERVICE ROLE key. Revoking anon does not touch it. The anon grant is a real
    limiter bypass: the Worker ingest path is metered, a direct PostgREST RPC
    with the public anon key is charged nothing.
  - log_open_event has ZERO callers repo-wide.

ALSO SHIPPED — the durable half, and it needs nobody:
  scripts/verify/migration-grants.mjs gained two static rules with a
  per-function timeline (checks D definer-public-execute, E
  definer-no-search-path), already covered by the existing CI step at
  .github/workflows/verify.yml:70-72.

REMAINING WORK ON THIS TASK:
  1. Matthew applies 202608091400. Then, IN ONE CHANGE:
       pnpm verify:rls-snapshot --write
       delete the log_analytics_event + log_open_event entries from
         ANON_CALLABLE_SECDEF (tests/unit/rls-cross-tenant.test.ts)
       delete the matching scripts/verify/db-grants-allow.json entries
     Those edits are mutually blocking — doing either alone turns verify:unit red.
  2. resolve_trigger_destination is NOT part of this task any more. Split out —
     see the separate blocked task.

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

Security & Secrets

NEEDS MATTHEW: audit every SECURITY DEFINER function for the PUBLIC execute grant