Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Launch TacTile›Foundations›Security & Secrets·26 in this wave

Approve: Security & SecretsTo do · blocker NEEDS MATTHEW: audit every SECURITY DEFINER function for the PUBLIC execute grantTo do · blocker Per-account rate limiting on write endpointsDone Rate limit auth endpointsDone Agent-run pre-launch security auditTo do Rotate all credentials at production cut-overTo do Encrypt card connector tokens — currently plaintextTo do Make the cookie banner actually gate non-essential storageDone NEEDS MATTHEW NOW: anon can delete any account — one REVOKE closes itDone NEEDS MATTHEW: v_account_tier leaks the full customer roster to anon — confirmed liveDone Add in-product Report link on the public destination viewerTo do Contact PATCH was wiping every card field — fixed, PR #164Done NEEDS MATTHEW: GitHub Actions billing wall — all CI is blockedDone Enable Supabase leaked-password protectionTo do Publish security.txt (vulnerability disclosure)Done Confirm sandbox flag unset in productionDone Add CORS middleware to tactile-apiDone Add CSP header on web responsesDone Add HSTS headerDone SAST scanning in CIDone Cookie consent bannerDone Audit log table for sensitive opsDone Add abuse-report endpointDone Document secrets inventoryTo do Dependency scanning in CIDone Agent-harness escape strings were shipping in page source — stripped, PR #167Done

Wave

Security & Secrets

v1.0 security hardening + secrets discipline. Agent-run security audit before production cut-over (no third-party pen test for v1.0).

TacTile › Launch TacTile › Foundations › Security & Secrets

18/26 done8 open2 open blockers

Selected taskclear

Add in-product Report link on the public destination viewer

To doOwner · Vivt_b3995b85

Entry point for POST /api/abuse/report. The endpoint exists; nothing in the product calls it yet.

Waiting on 1 · all clearAdd abuse-report endpoint

Unlocks 1Approve: Security & Secrets

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**Add in-product Report link on the public destination viewer** · to do

Entry point for POST /api/abuse/report. The endpoint exists; nothing in the product calls it yet.

Where it sits: TacTile › Launch TacTile › Foundations › Security & Secrets

## Waiting on 1

- Add abuse-report endpoint — done

## Unlocks 1

- Approve: Security & Secrets

## The brief on file

Viv — build the in-product Report link that calls the abuse-report endpoint, and surface anything needing Matthew's sign-off.

The backend landed 2026-07-29 (t_de4f0c5a, branch feature/abuse-report). Nothing in the product calls it, so an abuse report is currently only possible by email — which the Acceptable Use Policy §4 now describes as the fallback, not the primary path. This task closes that gap.

What exists to build against:
- POST /api/abuse/report — body { hash, category, details, url?, reporter_email?, reporter_name? } -> { success, report_id }. Unauthenticated. Per-IP throttle of 10/hour. Returns 400 on a bad category or missing details, 429 when throttled.
- GET /api/abuse/categories -> [{ id, severity }] for all 13 categories. RENDER THE FORM FROM THIS, do not hardcode a copy — the taxonomy is pinned to the DB CHECK constraint by a test, and a hardcoded list will drift.

Where it goes: the public destination viewer at /t/[hash] (apps/web), and the equivalent in apps/web-mobile. The hash the form submits is the one already in the route.

Design constraints that are not negotiable, because they are why the endpoint was built the way it was:
- No account required and no login prompt. Someone who scanned a fraudulent tag in the street is the primary user.
- Reporter name and email must be genuinely optional, and the form should say that leaving them blank is fine — it costs the acknowledgement, not the report. Requiring contact details suppresses reports from the people most at risk from the content.
- On success, show the report_id and say plainly what happens next (2 business days, faster for the critical categories). Do not claim the destination has been removed.
- Do not reveal whether the hash resolved to anything. The endpoint is deliberately uniform on that point so it cannot be used to enumerate destinations; a UI that says "no such tag" would undo it.

Consider Turnstile on the form. The endpoint's per-IP window is the only bot defence today, and it was left that way because a widget needs a form to live on — which this task creates.

Reference: apps/api/tactile-api/src/routes/abuse.ts, docs/legal/acceptable-use-policy.md §4, docs/white-label/OPS_RUNBOOK_ABUSE.md.

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

Security & Secrets

Add in-product Report link on the public destination viewer