Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Launch TacTile›Foundations›Security & Secrets·29 in this wave

Approve: Security & SecretsTo do · blocker NEEDS MATTHEW: audit every SECURITY DEFINER function for the PUBLIC execute grantTo do · blocker DO NOT RUN: the armed Stripe live-webhook rotation script would leave prod rejecting every webhookBlocked · blocker Per-account rate limiting on write endpointsDone Rate limit auth endpointsDone Agent-run pre-launch security auditDone Rotate all credentials at production cut-overTo do Encrypt card connector tokens — currently plaintextTo do Make the cookie banner actually gate non-essential storageDone NEEDS MATTHEW NOW: anon can delete any account — one REVOKE closes itDone NEEDS MATTHEW: v_account_tier leaks the full customer roster to anon — confirmed liveDone Add in-product Report link on the public destination viewerBlocked Contact PATCH was wiping every card field — fixed, PR #164Done NEEDS MATTHEW: GitHub Actions billing wall — all CI is blockedDone Apply the October DB hardening batch (F-1 anon public-destinations read + 5 drafted migrations)To do runs.tactile.to is on the open internet behind only an app passwordTo do Enable Supabase leaked-password protectionTo do Publish security.txt (vulnerability disclosure)Done Confirm sandbox flag unset in productionDone Add CORS middleware to tactile-apiDone Add CSP header on web responsesDone Add HSTS headerDone SAST scanning in CIDone Cookie consent bannerDone Audit log table for sensitive opsDone Add abuse-report endpointDone Document secrets inventoryDone Dependency scanning in CIDone Agent-harness escape strings were shipping in page source — stripped, PR #167Done

Wave

Security & Secrets

v1.0 security hardening + secrets discipline. Agent-run security audit before production cut-over (no third-party pen test for v1.0).

TacTile › Launch TacTile › Foundations › Security & Secrets

20/29 done9 open3 open blockers

Selected taskclear

Apply the October DB hardening batch (F-1 anon public-destinations read + 5 drafted migrations)

To doOwner · met_a70b73b9

Six drafted production migrations, F-1 among them, each applied by Matthew on its own named yes per runbook doc 2 on https://github.com/TacTile-dev/TacTile/pull/732. Filed in the Security wave but serves both the Security (t_0383f11c) and Database (t_6d3c02a5) gates, which approve with it as a named follow-up; it blocks the launch task.

No dependencies in this wave — nothing gates it, and nothing waits on it.

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**Apply the October DB hardening batch (F-1 anon public-destinations read + 5 drafted migrations)** · to do

Six drafted production migrations, F-1 among them, each applied by Matthew on its own named yes per runbook doc 2 on https://github.com/TacTile-dev/TacTile/pull/732. Filed in the Security wave but serves both the Security (t_0383f11c) and Database (t_6d3c02a5) gates, which approve with it as a named follow-up; it blocks the launch task.

Where it sits: TacTile › Launch TacTile › Foundations › Security & Secrets

## The brief on file

[2026-10-08 · Viv] WAITING ON MATTHEW — supersedes any earlier block below
DECISION: PRODUCTION, one step IRREVERSIBLE: apply the October DB hardening batch, six migrations with one named yes each (the F-1 anon public-destinations read is #5 of 6)?
RECOMMEND: Yes to all six, after the 9 Oct deploy, in the order in doc 2 on https://github.com/TacTile-dev/TacTile/pull/732: F-1 is the only gap that lets anyone with the public anon key read customer content (public destinations, including Wi-Fi password and payment rows), and the client sweep found no first-party app that breaks when it closes.
IF YES, NEXT: One sitting of about 90 minutes, about 25 of them yours, or F-1 alone in about 10. Per migration: Viv runs the read-only precheck and hands you the query; you give the named yes and apply it with Supabase MCP apply_migration, which every migration header reserves for you; Viv runs the postcheck. Order: 202608312310, 202608312330, 202609030930, 202608312340, 202608272335 statement 1 (F-1), and 202608312320 last and alone (it touches sign-up; its postcheck is one throwaway signup, yours). After F-1 you check that your destinations list and one editor load in the app on your phone (1 min). Viv then records the batch in one commit.
COST IF YES: About 25 minutes of yours, $0. 202609030930 is the irreversible one: it arms the nightly purge, which then really deletes analytics for accounts whose purge date has passed; skip it if its precheck lists a real customer.
COST IF NO: New task that blocks the launch task (2 open tasks downstream, 0 of them Kaitlynn's), and public Wi-Fi password, payment and menu rows stay bulk-readable with the published anon key, any signed-in user can read any account's tier, and the account purge stays broken.
SAFE TO ASSUME: Agents never call apply_migration on prod; the profiles and scan-recording migrations are not in this batch.

AGENT BRIEF (Viv or a coding agent; no prod writes by agents)
Runbook: docs/runbooks/apply-db-hardening-2026-10.md on https://github.com/TacTile-dev/TacTile/pull/732 (worktree ~/TacTile-dev/TacTile-deploy-runbook-1009, branch r30/deploy-runbook). Precondition: the 9 Oct deploy runbook (t_a050ee07) is finished.
Per migration, in the runbook's order: run the read-only precheck via Supabase MCP execute_sql (project xtzqmvfhtremtmbzykeq); stop and report if it does not match the runbook; produce the query with grep -vxE 'begin;|commit;' supabase/migrations/<file>.sql; Matthew applies with apply_migration after his named yes for that file; run the postcheck; record the version stamp from list_migrations. Never call apply_migration or any rollback yourself; never supabase db push.
Before #5 (F-1): run the one-line pg_views/pg_proc search for 'destinations' (the client sweep could not list live-only views/functions). After #5: postcheck 6's device half (destinations list and one editor load in the iOS app) is Matthew's, on his own phone, 1 min; no agent can drive a TestFlight device.
Before #3 (202609030930): show Matthew the precheck's list of accounts with analytics_purge_at set; skip on any real customer.
After the batch: follow 'The follow-up commit' in apply-db-hardening-2026-10.md steps 1-6 verbatim: applied banners on applied files only, fixture refresh, baseline edits (#4 allowlist rewrite, #5 PENDING_M1_CLOSURE comment, #6 KNOWN_OPEN_SECDEF rows; KNOWN_OPEN_PUBLISHED is already empty), RECONCILIATION.md. In the same commit, also regenerate tests/fixtures/rls/replica-schema.sql and, in tests/rls/cross-tenant-runtime.test.ts, flip 'lets anon read a destination published as public' to assert 0 rows and retire or rewrite the soft-deleted public destination probe. This is required, not optional as the runbook says: scripts/rls/start-replica.sh aborts when the replica's policies differ from the refreshed snapshot, and the replica still carries p_destinations_public_select.
Done when: list_migrations shows every applied file, get_advisors is re-run, pnpm test:rls passes on 93 of 93 tables, run-all.sh gives 55 passed + the 1 known-red, verify:db-grants and verify:rls-snapshot print live results (a SKIP is not a pass), the commit is merged, and the follow-up notes on t_6d3c02a5 and t_0383f11c are updated.

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

Security & Secrets

Apply the October DB hardening batch (F-1 anon public-destinations read + 5 drafted migrations)