Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Launch TacTile›Foundations›Security & Secrets·29 in this wave

Approve: Security & SecretsTo do · blocker NEEDS MATTHEW: audit every SECURITY DEFINER function for the PUBLIC execute grantTo do · blocker DO NOT RUN: the armed Stripe live-webhook rotation script would leave prod rejecting every webhookBlocked · blocker Per-account rate limiting on write endpointsDone Rate limit auth endpointsDone Agent-run pre-launch security auditDone Rotate all credentials at production cut-overTo do Encrypt card connector tokens — currently plaintextTo do Make the cookie banner actually gate non-essential storageDone NEEDS MATTHEW NOW: anon can delete any account — one REVOKE closes itDone NEEDS MATTHEW: v_account_tier leaks the full customer roster to anon — confirmed liveDone Add in-product Report link on the public destination viewerBlocked Contact PATCH was wiping every card field — fixed, PR #164Done NEEDS MATTHEW: GitHub Actions billing wall — all CI is blockedDone Apply the October DB hardening batch (F-1 anon public-destinations read + 5 drafted migrations)To do runs.tactile.to is on the open internet behind only an app passwordTo do Enable Supabase leaked-password protectionTo do Publish security.txt (vulnerability disclosure)Done Confirm sandbox flag unset in productionDone Add CORS middleware to tactile-apiDone Add CSP header on web responsesDone Add HSTS headerDone SAST scanning in CIDone Cookie consent bannerDone Audit log table for sensitive opsDone Add abuse-report endpointDone Document secrets inventoryDone Dependency scanning in CIDone Agent-harness escape strings were shipping in page source — stripped, PR #167Done

Wave

Security & Secrets

v1.0 security hardening + secrets discipline. Agent-run security audit before production cut-over (no third-party pen test for v1.0).

TacTile › Launch TacTile › Foundations › Security & Secrets

20/29 done9 open3 open blockers

Selected taskclear

runs.tactile.to is on the open internet behind only an app password

To doOwner · met_c9d4fcf7

Add runs.tactile.to as an additional hostname on the existing 'TacTile Internal' Cloudflare Access app (emailed one-time code) without touching the shared tunnel, per the audit addendum on https://github.com/TacTile-dev/TacTile/pull/734. It blocks the launch task.

No dependencies in this wave — nothing gates it, and nothing waits on it.

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**runs.tactile.to is on the open internet behind only an app password** · to do

Add runs.tactile.to as an additional hostname on the existing 'TacTile Internal' Cloudflare Access app (emailed one-time code) without touching the shared tunnel, per the audit addendum on https://github.com/TacTile-dev/TacTile/pull/734. It blocks the launch task.

Where it sits: TacTile › Launch TacTile › Foundations › Security & Secrets

## The brief on file

[2026-10-08 · Viv] WAITING ON MATTHEW — supersedes any earlier block below
DECISION: PRODUCTION: put Cloudflare Access (an emailed one-time code) in front of runs.tactile.to, which is on the open internet behind only an app password?
RECOMMEND: Yes, Access rather than taking the tunnel down: the same tunnel also carries local-router.tactile.to, and the audit addendum (https://github.com/TacTile-dev/TacTile/pull/734) found /health answering unauthenticated, three Next advisories reachable there, and an engine that starts Claude agent sessions on your Mac. You opted out of Access earlier over Google SSO overhead; this is the emailed code your hub already uses, no SSO.
IF YES, NEXT: You, about 5 min in Cloudflare Zero Trust: Access > Applications > the existing 'TacTile Internal' app > add runs.tactile.to as an additional public hostname (docs/internal-apps/AUTH_AND_ACCESS.md), keeping its Matthew policy and emailed-code login. Viv then confirms /health and /_next/image redirect to the Access login and fixes the runs-engine doc line that says "not exposed publicly".
COST IF YES: About 5 minutes, $0 (free tier, 50 seats); the same sign-in as the hub, an emailed code whenever its 24-hour session lapses.
COST IF NO: New task that blocks the launch task (2 open tasks downstream, 0 of them Kaitlynn's), and anyone with the app password, or anyone hitting the Next image optimizer, reaches a process on your Mac.
SAFE TO ASSUME: Viv leaves the tunnel, local-router.tactile.to and the engine untouched. local-router.tactile.to has its own secret-path auth and a read-only profile; it stays cross-lane, for Nova.

AGENT BRIEF (Viv or a coding agent)
Source: docs/audit/2026-10-08-prelaunch-audit-addendum.md on https://github.com/TacTile-dev/TacTile/pull/734 (finding 3, Decision 3).
After Matthew says runs.tactile.to is on the 'TacTile Internal' Access app: curl -sI https://runs.tactile.to/health and https://runs.tactile.to/_next/image must both return a redirect to the Cloudflare Access login (tactile-c6.cloudflareaccess.com), and https://local-router.tactile.to must behave exactly as before.
Then, in a ~/TacTile-dev/TacTile-* worktree, a docs PR correcting apps/runs-engine/AGENTS.md:23 ("not exposed publicly") to say it is reachable at runs.tactile.to behind Cloudflare Access; file the addendum's F9 (runs apps Next upgrade) as its own task.
Never edit ~/.cloudflared/config.yml or the com.tactile.runs-tunnel LaunchAgent, never stop the tunnel. local-router.tactile.to (secret-path auth, read-only profile per ~/.cloudflared/config.yml) is cross-lane: raise it with Nova, do not act on it.
Done when the curl checks pass and the doc PR is open.

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

Security & Secrets

runs.tactile.to is on the open internet behind only an app password