Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Launch TacTile›Foundations›Security & Secrets·26 in this wave

Approve: Security & SecretsTo do · blocker NEEDS MATTHEW: audit every SECURITY DEFINER function for the PUBLIC execute grantTo do · blocker Per-account rate limiting on write endpointsDone Rate limit auth endpointsDone Agent-run pre-launch security auditTo do Rotate all credentials at production cut-overTo do Encrypt card connector tokens — currently plaintextTo do Make the cookie banner actually gate non-essential storageDone NEEDS MATTHEW NOW: anon can delete any account — one REVOKE closes itDone NEEDS MATTHEW: v_account_tier leaks the full customer roster to anon — confirmed liveDone Add in-product Report link on the public destination viewerTo do Contact PATCH was wiping every card field — fixed, PR #164Done NEEDS MATTHEW: GitHub Actions billing wall — all CI is blockedDone Enable Supabase leaked-password protectionTo do Publish security.txt (vulnerability disclosure)Done Confirm sandbox flag unset in productionDone Add CORS middleware to tactile-apiDone Add CSP header on web responsesDone Add HSTS headerDone SAST scanning in CIDone Cookie consent bannerDone Audit log table for sensitive opsDone Add abuse-report endpointDone Document secrets inventoryTo do Dependency scanning in CIDone Agent-harness escape strings were shipping in page source — stripped, PR #167Done

Wave

Security & Secrets

v1.0 security hardening + secrets discipline. Agent-run security audit before production cut-over (no third-party pen test for v1.0).

TacTile › Launch TacTile › Foundations › Security & Secrets

18/26 done8 open2 open blockers

Selected taskclear

Cookie consent banner

DoneOwner · Vivt_a062b929

Consent UI reflecting the Cookie Policy; blocks non-essential cookies until consent.

Unlocks 1Approve: Security & Secrets

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**Cookie consent banner** · done

Consent UI reflecting the Cookie Policy; blocks non-essential cookies until consent.

Where it sits: TacTile › Launch TacTile › Foundations › Security & Secrets

## Unlocks 1

- Approve: Security & Secrets

## The brief on file

CLOSED 2026-07-28 — no consent banner is needed, and this was verified in code rather than assumed. Matthew's call: "We're not doing any cookies, so we don't need to ask for consent... I don't want people to have to choose something that we already don't do."

VERIFICATION PERFORMED (this is the evidence behind a public claim, so it is recorded in full):
1. PUBLIC SCAN PATH — apps/web/app/t/[hash]/route.ts sets NO cookie and touches NO localStorage or sessionStorage. Grepped, zero matches. This is the path every scanned tag hits, so it is the one that matters most.
2. VISITOR IDENTIFICATION — apps/api/tactile-api/src/routes/events.ts:120-131 identifies visitors via computeVisitorHash(secret, ip, userAgent) and computeVisitorYearHash(...). That is a SERVER-SIDE salted hash of IP + user agent. Nothing is written to the visitor's device at any point — the same cookieless approach Plausible and Fathom use.
3. ANALYTICS FEATURE — apps/web/features/analytics contains zero localStorage or sessionStorage usage.
4. THE ONLY COOKIES IN THE WEB APP, both strictly necessary and therefore exempt from consent under ePrivacy Art. 5(3): the Supabase auth session (lib/supabase/server.ts) and a device-trust security token (system/auth/device-trust.ts).

CONCLUSION: no non-essential storage exists, so there is nothing to consent to. A banner would be theatre and a worse experience.

TWO THINGS THAT REMAIN TRUE AND MUST STILL BE HANDLED IN THE POLICIES (tracked under the Legal wave, not here):
- The visitor hash is still PERSONAL DATA under GDPR — pseudonymised, not anonymised, since it can single out a person. It needs a stated lawful basis (legitimate interest is the normal one here) and must be described in the Privacy Policy. It does not need CONSENT, because consent under ePrivacy attaches to storing things on a device, and nothing is stored. That distinction is the whole argument and should be stated plainly.
- Customer-enabled third-party integrations (Google Analytics, Meta, Segment, Zapier) DO set third-party cookies when switched on. For those the customer is the controller and the provider's terms apply — per Matthew: "If they wanna do a Google integration, Google can take on the weight of privacy problems." The integration settings screen should say so at the moment of enabling.

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

Security & Secrets

Cookie consent banner