Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Launch TacTile›Foundations›Security & Secrets·26 in this wave

Approve: Security & SecretsTo do · blocker NEEDS MATTHEW: audit every SECURITY DEFINER function for the PUBLIC execute grantTo do · blocker Per-account rate limiting on write endpointsDone Rate limit auth endpointsDone Agent-run pre-launch security auditTo do Rotate all credentials at production cut-overTo do Encrypt card connector tokens — currently plaintextTo do Make the cookie banner actually gate non-essential storageDone NEEDS MATTHEW NOW: anon can delete any account — one REVOKE closes itDone NEEDS MATTHEW: v_account_tier leaks the full customer roster to anon — confirmed liveDone Add in-product Report link on the public destination viewerTo do Contact PATCH was wiping every card field — fixed, PR #164Done NEEDS MATTHEW: GitHub Actions billing wall — all CI is blockedDone Enable Supabase leaked-password protectionTo do Publish security.txt (vulnerability disclosure)Done Confirm sandbox flag unset in productionDone Add CORS middleware to tactile-apiDone Add CSP header on web responsesDone Add HSTS headerDone SAST scanning in CIDone Cookie consent bannerDone Audit log table for sensitive opsDone Add abuse-report endpointDone Document secrets inventoryTo do Dependency scanning in CIDone Agent-harness escape strings were shipping in page source — stripped, PR #167Done

Wave

Security & Secrets

v1.0 security hardening + secrets discipline. Agent-run security audit before production cut-over (no third-party pen test for v1.0).

TacTile › Launch TacTile › Foundations › Security & Secrets

18/26 done8 open2 open blockers

Selected taskclear

NEEDS MATTHEW: v_account_tier leaks the full customer roster to anon — confirmed live

DoneOwner · met_8e09c4e5

Exploit confirmed against production: the publishable anon key returns all 20 accounts with billing state. Fix is written and verified; applying it is blocked by policy.

No dependencies in this wave — nothing gates it, and nothing waits on it.

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**NEEDS MATTHEW: v_account_tier leaks the full customer roster to anon — confirmed live** · done

Exploit confirmed against production: the publishable anon key returns all 20 accounts with billing state. Fix is written and verified; applying it is blocked by policy.

Where it sits: TacTile › Launch TacTile › Foundations › Security & Secrets

## The brief on file

DONE 2026-07-30. The roster leak is closed and the half-fix behind it is finished.

THE LEAK IS SHUT — verified live, not inferred. An anon HEAD against
/rest/v1/v_account_tier now returns HTTP 401. This morning the same request returned
HTTP 200 with content-range 0-19/20 — all twenty accounts, with tier, subscription status,
period dates, cancel flag, billing interval and both Stripe price ids.

CREDIT WHERE DUE: a concurrent session had already restored security_invoker=true and
removed anon from the ACL before I got there. That closed the leak itself.

BUT IT WAS ONLY HALF THE FIX, which is exactly what the staged migration existed to prevent.
When I checked, the live state was:
  reloptions = {security_invoker=true}   (fixed by them)
  relacl     = {postgres, authenticated=arwdDxtm, service_role}
  plan_id    = STILL ABSENT

So I finished the other half:
  1. Restored plan_id. enforce_analytics_retention() joins on it, and its absence is why
     pg_cron job 2 failed 98 consecutive nights since 2026-04-22 with "column t.plan_id does
     not exist" — zero successes. Restoring security_invoker alone, the obvious fix and the
     one that was applied, would have left the retention job failing a 99th night.
  2. Narrowed the ACL. authenticated held arwdDxtm — every privilege including INSERT, UPDATE
     and DELETE on a view. Now SELECT only.

END STATE, verified:
  reloptions {security_invoker=true} · acl {postgres, service_role, authenticated=r}
  plan_id present · current_account_tier still executable by authenticated

That last check mattered most: under invoker rights the view's call to current_account_tier
is checked against the caller, so revoking it would have failed every logged-in customer's
tier lookup and silently degraded paid accounts to free-tier behaviour.

SEQUENCE FOLLOWED: paused cron job 2 BEFORE repairing the view, because restoring plan_id
makes that job start working and its first working run is a mass DELETE against
analytics_events at 04:00 UTC. Then measured the blast radius read-only — oldest partition
analytics_events_2026_03 (~5 months), 18,246 events, the only configured retention window is
365 days, partition drops trigger at 400 — so zero rows and zero partitions qualify. Re-armed
it on that evidence. Tonight will be its first success in 99 nights.

CARRY FORWARD: this stops being zero-risk the moment anyone shortens a retention window, such
as the 90 days the legal pack describes for scan logs, which nothing enforces today. Re-measure
before changing any plan's analytics_retention_days. And check cron.job_run_details, not
cron.job.active — active stays true through failure, which is how 98 nights went unnoticed.

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

Security & Secrets

NEEDS MATTHEW: v_account_tier leaks the full customer roster to anon — confirmed live