Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Launch TacTile›Foundations›Security & Secrets·29 in this wave

Approve: Security & SecretsTo do · blocker NEEDS MATTHEW: audit every SECURITY DEFINER function for the PUBLIC execute grantTo do · blocker DO NOT RUN: the armed Stripe live-webhook rotation script would leave prod rejecting every webhookBlocked · blocker Per-account rate limiting on write endpointsDone Rate limit auth endpointsDone Agent-run pre-launch security auditDone Rotate all credentials at production cut-overTo do Encrypt card connector tokens — currently plaintextTo do Make the cookie banner actually gate non-essential storageDone NEEDS MATTHEW NOW: anon can delete any account — one REVOKE closes itDone NEEDS MATTHEW: v_account_tier leaks the full customer roster to anon — confirmed liveDone Add in-product Report link on the public destination viewerBlocked Contact PATCH was wiping every card field — fixed, PR #164Done NEEDS MATTHEW: GitHub Actions billing wall — all CI is blockedDone Apply the October DB hardening batch (F-1 anon public-destinations read + 5 drafted migrations)To do runs.tactile.to is on the open internet behind only an app passwordTo do Enable Supabase leaked-password protectionTo do Publish security.txt (vulnerability disclosure)Done Confirm sandbox flag unset in productionDone Add CORS middleware to tactile-apiDone Add CSP header on web responsesDone Add HSTS headerDone SAST scanning in CIDone Cookie consent bannerDone Audit log table for sensitive opsDone Add abuse-report endpointDone Document secrets inventoryDone Dependency scanning in CIDone Agent-harness escape strings were shipping in page source — stripped, PR #167Done

Wave

Security & Secrets

v1.0 security hardening + secrets discipline. Agent-run security audit before production cut-over (no third-party pen test for v1.0).

TacTile › Launch TacTile › Foundations › Security & Secrets

20/29 done9 open3 open blockers

Selected taskclear

Encrypt card connector tokens — currently plaintext

To doOwner · Vivt_c82554db

Unlocks 1Approve: Security & Secrets

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**Encrypt card connector tokens — currently plaintext** · to do

Where it sits: TacTile › Launch TacTile › Foundations › Security & Secrets

## Unlocks 1

- Approve: Security & Secrets

## The brief on file

[2026-10-16 · Viv] CORRECTION to the 15 Oct block below on one point, WHICH sitting; the rest stands. "bundle" stays a plan yes, but #735 does not merge in the t_a050ee07 first sitting (#722, #723, #727, #718). It merges in the deploy sitting after MERGE-QUEUE step 8, once #682 and #707 are in and #737 and #759 are in (step 6), and you apply 202610082330 in that same sitting (Workers first, then the one-file apply).
WHY (checked 16 Oct, main 4f2c1d6b): #735 (3aaec969) overlaps #682 (5d725f14) in resolveApproval in agent.ts and at the end of agent-approval-resolution.test.ts, and #707 (f441736a) in packages/agent-core/AGENTS.md, so whichever lands second takes the merge-main. #735 is my own r30 branch, so merging main into it needs no standing go, whereas landing it first would force merge-main pushes onto #682 and #707, both r28 (t_bc885035). #737 (fa590ffe) must land first: its 202610082100-2102 files sort before 202610082330, so behind #735 they fail #759's order test. The first sitting was approved small on 8 Oct and carries the profiles privacy fix, 6 days late as of 15 Oct. The 15 Oct "COST IF NO: a second API deploy" is moot, because the queue already has a second API, web and MCP deploy; migration safety is unchanged (0 card rows, both orders fail closed, the only exposure is a Popl connect before that deploy).
Order of record: docs/launch/MERGE-QUEUE.md lines 115, 128 and 237, updated 16 Oct to match.

[2026-10-15 · Viv] WAITING ON MATTHEW — supersedes the 8 Oct PREPARED note below (its push and optional fixes are done: 84a9e629, 3aaec969)
DECISION: PRODUCTION: fold the card-token Vault into the t_a050ee07 production sitting: you merge draft #735 in its pre-run batch, both Workers (tactile-api, tactile-mcp-server) deploy, then you give a named yes to apply DDL migration 202610082330 on the no-backup prod DB?
RECOMMEND: Yes, bundled. #735 is current (head 3aaec969 on today's main 4f2c1d6b, mergeable); its only red check is the secrets-rotation audit, which main's own 15 Oct run fails the same way; prod is untouched (read-only, 15 Oct 23:26 PDT: 0 card rows, 0 Vault secrets, no RPCs, migration absent); and the SQL aborts itself on any Vault or end-state surprise. The table is empty, so this is the cheapest it will ever be, and a separate sitting costs a second API deploy.
IF YES, NEXT: Reply "bundle" (a plan yes, not a merge or an apply). Viv then updates the 9 Oct deploy runbook (#732) for the moved main; adds the hand deploy of tactile-mcp-server (`wrangler deploy --config apps/api/tactile-api/wrangler.mcp.jsonc`, outside deploy.sh so its gates do not apply); reconciles the PR body (code after apply) with the migration header (Workers first; both orders fail closed, Workers first is the shorter outage); replays the exact stripped file in a throwaway Postgres 17 before the sitting (the 8 Oct note says that was done, the PR body says the whole file never ran); and sequences #737 ahead of #735 (its 202610082100-2102 files would fail #759's order test behind 202610082330). In the sitting: you merge #735 with #722/#723/#727, both Workers deploy and wrangler deployments status confirms, you apply 202610082330 yourself via Supabase MCP apply_migration (begin/commit stripped, about 5 min) and run the header's three read-only checks; Viv lands the bookkeeping as ONE commit (policy-snapshot.json and replica-schema.sql regenerated, DRAFT line to applied marker, the two db-grants entries kept) and closes this task.
COST IF YES: Adds the MCP deploy, a 5-minute apply and three checks to a 75-minute sitting; $0. Risk is low: 0 rows to move or lose, rollback SQL in the migration header, and in the minutes between the Worker deploy and the apply the card tools fail closed instead of storing anything. No backup is your 6 Oct call (a dump is not a precondition).
COST IF NO: Nothing is exposed tonight, but the first Popl connect on the deployed code stores a Teams-admin key in plaintext (a customer breach if read), a separate sitting later costs a second API deploy, and this task stays open and, through its edge into t_0383f11c, keeps 83 open tasks (27 Kaitlynn's) held.
SAFE TO ASSUME: No agent merges, deploys or applies without your named yes per write; merging #735 touches no database (no workflow applies migrations, never `supabase db push`); the key still passes through the model provider (DeepSeek), chat history and an unresolved proposal, which CARD-CONNECTORS.md documents and t_58981363 (yours) should list as a sub-processor.

[2026-10-08 · Viv] PREPARED, not done: Vault build on branch r30/card-token-vault, draft PR https://github.com/TacTile-dev/TacTile/pull/735; migration 202610082330 is DRAFT - NOT APPLIED; an adversarial review replayed it in a throwaway local Postgres 17 container and confirmed it. Not DONE, and the claim does not say it is. Remaining work, all Matthew-gated or later serial stages: push and merge; deploy BOTH Workers (tactile-api and tactile-mcp-server) and confirm with wrangler deployments status; then Matthew applies 202610082330 via the Supabase MCP (strip begin/commit per convention) and runs the header's after-apply checks. Then land the bookkeeping in ONE commit: policy-snapshot.json and replica-schema.sql regenerated, the DRAFT line replaced with the applied marker, and the two db-grants entries kept. Optional hardening before push: fix defect 1 (verify the secret exists before reusing secret_id) and reword the literal in the test at line 1551.

[DECIDED 30 Sep 2026 — Matthew: ENCRYPT IN PLACE (Vault). KEEP the card tools live.]
Build the RECOMMENDED DESIGN below (Supabase Vault-managed key) as one draft PR: migration NOT applied, code, and tests. Matthew applies the migration; it is DDL on a no-backup prod DB. Nothing for Matthew to provision.
Verified 30 Sep (read-only): card_connector_accounts has 0 rows in prod, so the backfill is a no-op; only Popl can be stored (card-connectors.ts:81-89); tools are callable via CUSTOMER_TOOLS.
ALSO IN SCOPE (residual exposure Vault-in-table does not close; mitigate, don't re-litigate):
- On the in-app agent path the full tool input, token included, is saved raw in agent_pending_actions.input (pendingActions.ts:56, replayed at agent.ts:1472/:1533, never cleared). It also lands in agent_audit_log.input and chat history. Redact the token from those rows once the action executes, and keep it out of the streamed preview.
- The key passes through the model provider (DeepSeek by default). Storage can't fix that. Note it in CARD-CONNECTORS.md and the privacy sub-processor work (t_58981363), and bring a one-liner back to Matthew if a settings-form entry path is wanted later.
- A Popl Teams-admin key reaches team-wide lead data, so a leak is a customer data-breach event, not just a stale credential.
Do NOT add any DROP TABLE, or a DROP COLUMN that loses data. Renaming the misleading column is fine with 0 rows.
[/DECIDED]

Viv — actually encrypt the card connector tokens. Done when: card_connector_accounts.encrypted_token holds ciphertext, decryption goes through Supabase Vault or an equivalent, and existing rows are migrated. FOUND BY AUDIT: the column is named encrypted_token but stores the value in plaintext. These are third-party access tokens for Popl, HiHello, Dot and Blinq imports, so a database read exposes live credentials to other people's services. The misleading column name makes this worse, because anyone reviewing the schema would reasonably assume it is already handled. Note the project already has supabase_vault installed and uses vault-key references elsewhere in integration_configs, so the pattern to follow exists.

[overnight 29→30 Sep] NEEDS MATTHEW — reply "Vault" (my recommendation) or "own key" and I build it as one draft PR. No backfill is needed: the table is empty. Prepared only; nothing changed.

WHAT I MEASURED (read-only, prod):
- public.card_connector_accounts has 0 rows, 0 owners. Nothing is stored in plaintext today, so "existing rows are migrated" is vacuous right now. The exposure starts the first time someone runs tactile.import_card with a token. RLS on; four owner policies (owner_account_id = auth.uid()).
- supabase_vault 0.3.1 and pgcrypto 1.3 are installed; vault.secrets = 0 rows and integration_configs = 0 rows. The pattern exists in code (202606121653_analytics_connector_rpcs.sql: SECURITY DEFINER set/get + vault.create_secret, service_role-only) but has never held a secret in prod.
- Where the token moves — packages/mcp-server/src/tools/card-connectors.ts only. Write: PostgREST upsert of card_connector_accounts under the user's JWT (:262-270). Reads: :102 (loadConnectorAccount), :153, :281, :442. The tools are in ALL_TOOLS/CUSTOMER_TOOLS, so they are callable today.
- Five places say "plaintext" or keep the column out of exports and would need correcting: the migration's SECURITY TODO, the card-connectors.ts header, packages/card-connectors/AGENTS.md (Security note), CARD-CONNECTORS.md:176-195, apps/api/tactile-api/src/routes/meDataExport.ts:155.

WHY THE CHOICE IS YOURS: (1) who owns the key; (2) the tools run as the USER (JWT), not service_role, so the analytics RPCs cannot be copied as-is.

RECOMMENDED DESIGN — Vault-managed key, nothing for you to provision:
1. Migration: add secret_id uuid; RPCs put_card_connector_token(p_source, p_token) and get_card_connector_token(p_source) — SECURITY DEFINER, set search_path = public, vault, pg_temp, scoped by auth.uid() (never a caller-supplied owner), source allow-list, EXECUTE revoked from PUBLIC/anon and granted to authenticated + service_role. The token goes in with vault.create_secret/update_secret under the name card_connector:<uid>:<source>.
2. Same migration: an idempotent backfill (any plaintext row -> vault, then null the column; a no-op today, covers a row landing before apply), then encrypted_token drop not null; a follow-up drops or renames the misleading column (0 rows = no loss). Drop the owner insert/update policies so token writes can only go through the RPC.
3. A BEFORE DELETE trigger on the table removes the vault secret. Account deletion cascades from auth.users and Vault rows are not FK-linked, so without it a deleted account leaves its provider token behind — a privacy bug, not just tidiness.
4. mcp-server: swap the five PostgREST sites for rpc/ calls, add tests, fix the five stale comments, and add the two RPCs to scripts/verify/db-grants-allow.json (authenticated-executable definer functions are allowlisted by review).
5. No API Worker change, no new secret, no rotation.

IF YOU SAY "Vault" -> I open the draft PR (migration NOT applied + code + tests); you apply.
IF YOU SAY "own key" -> app-layer AES-GCM in the API Worker: needs a 1Password item plus `wrangler secret put` from you and an API endpoint in front of the tools; more work and a key for you to custody.
ALSO YOURS TO CALL: until it ships, leave tactile.import_card callable (0 rows; a token would be stored plaintext if anyone connects Popl now) or make it stop persisting tokens (caller re-supplies per call, a product change). I would leave it: launch has not happened and no row exists.
MY READ: Vault, before launch. Cheapest path, no key custody, and the pattern is already in the repo.
SAFE TO ASSUME: nothing was changed.

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

Security & Secrets

Encrypt card connector tokens — currently plaintext