Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Launch TacTile›Foundations›Security & Secrets·29 in this wave

Approve: Security & SecretsTo do · blocker NEEDS MATTHEW: audit every SECURITY DEFINER function for the PUBLIC execute grantTo do · blocker DO NOT RUN: the armed Stripe live-webhook rotation script would leave prod rejecting every webhookBlocked · blocker Per-account rate limiting on write endpointsDone Rate limit auth endpointsDone Agent-run pre-launch security auditDone Rotate all credentials at production cut-overTo do Encrypt card connector tokens — currently plaintextTo do Make the cookie banner actually gate non-essential storageDone NEEDS MATTHEW NOW: anon can delete any account — one REVOKE closes itDone NEEDS MATTHEW: v_account_tier leaks the full customer roster to anon — confirmed liveDone Add in-product Report link on the public destination viewerBlocked Contact PATCH was wiping every card field — fixed, PR #164Done NEEDS MATTHEW: GitHub Actions billing wall — all CI is blockedDone Apply the October DB hardening batch (F-1 anon public-destinations read + 5 drafted migrations)To do runs.tactile.to is on the open internet behind only an app passwordTo do Enable Supabase leaked-password protectionTo do Publish security.txt (vulnerability disclosure)Done Confirm sandbox flag unset in productionDone Add CORS middleware to tactile-apiDone Add CSP header on web responsesDone Add HSTS headerDone SAST scanning in CIDone Cookie consent bannerDone Audit log table for sensitive opsDone Add abuse-report endpointDone Document secrets inventoryDone Dependency scanning in CIDone Agent-harness escape strings were shipping in page source — stripped, PR #167Done

Wave

Security & Secrets

v1.0 security hardening + secrets discipline. Agent-run security audit before production cut-over (no third-party pen test for v1.0).

TacTile › Launch TacTile › Foundations › Security & Secrets

20/29 done9 open3 open blockers

Selected taskclear

Audit log table for sensitive ops

DoneOwner · ait_5f133c60

Append-only log of sensitive actions (auth changes, billing, deletions).

Unlocks 2Agent-run pre-launch security audit Approve: Security & Secrets

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**Audit log table for sensitive ops** · done

Append-only log of sensitive actions (auth changes, billing, deletions).

Where it sits: TacTile › Launch TacTile › Foundations › Security & Secrets

## Unlocks 2

- Agent-run pre-launch security audit
- Approve: Security & Secrets

## The brief on file

DONE 2026-07-28 (Viv) — PR #162, branch feature/audit-call-sites. Steps 1-3 of
docs/audit-log.md complete; step 4 (immutability test) spun out separately.

emitAudit() had ZERO call sites. It now has real ones across 8 API files plus both Deno
edge functions. 11 of 16 actions wired; the other 5 are named, not rounded to done.

WIRED: billing.tier_changed, billing.cancelled, billing.payment_failed,
billing.payment_method_changed, billing.webhook_rejected (new to the union),
account.deleted, domain.added, domain.removed, domain.verification_failed,
destination.deleted, oauth.token_revoked.

FOUR CORRECTIONS TO MY BRIEF — the agents were right, I was wrong:
 1. account.email_changed / account.password_changed are BUILT, not missing. They bypass
    the API entirely — the web app calls supabase.auth.updateUser() client-side
    (apps/web/app/(app)/settings/security/page.tsx:115), so nothing server-side can hook
    them. Unauditable BY DESIGN until routed through the API or a Supabase auth hook. The
    legal pack implies they are logged. They are not.
 2. oauth.client_registered is not absent either — it lives in packages/mcp-server and
    cannot import emitAudit (hard import rule 3). Separate task.
 3. The three inactivity actions are on an unmerged branch that already adds them. Two
    agents correctly declined to duplicate them.
 4. The union had 15 members on main, not 14; verify:migration-grants is not on this branch.

WHAT VERIFY CAUGHT THAT NO WIRING AGENT DID:
 - oauth.token_revoked was neither wired nor reported — a silent hole. Now at
   routes/agent.ts:1334 and :1359. Its 404 branch logs failure while leaving the response
   ok:true — a grant the customer thinks is revoked and isn't.
 - customDomainHealth.ts minted a fresh request id per row inside the loop while claiming
   to correlate the sweep. One per sweep now.
 - A redaction collision: `oauth_client_id` contains "auth", so it would have arrived
   "[redacted]". Renamed, then all 28 sites checked against the real shouldRedact — clean.

THREE DESIGN NOTES: a Deno mirror at supabase/functions/_shared/audit.ts follows the
_shared/sentry.ts precedent, with a parity test asserting containment not equality.
Unsigned webhook POSTs are deliberately NOT audited (rows can't be pruned, so a stranger
could grow a table we can't shrink); a wrong-but-present signature IS. account.deleted
can't keep its subject id — both FKs are ON DELETE SET NULL — so target_id carries it.

VERIFIED: verify:unit 67 files / 2193 tests green; arch + agents-sync pass; tsc
byte-identical (12 pre-existing mcp-server errors). depcruise red, all 31 in
apps/tactile-hub, outside this diff. No DB modified, nothing deployed.

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

Security & Secrets

Audit log table for sensitive ops