Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Launch TacTile›Foundations›Security & Secrets·29 in this wave

Approve: Security & SecretsTo do · blocker NEEDS MATTHEW: audit every SECURITY DEFINER function for the PUBLIC execute grantTo do · blocker DO NOT RUN: the armed Stripe live-webhook rotation script would leave prod rejecting every webhookBlocked · blocker Per-account rate limiting on write endpointsDone Rate limit auth endpointsDone Agent-run pre-launch security auditDone Rotate all credentials at production cut-overTo do Encrypt card connector tokens — currently plaintextTo do Make the cookie banner actually gate non-essential storageDone NEEDS MATTHEW NOW: anon can delete any account — one REVOKE closes itDone NEEDS MATTHEW: v_account_tier leaks the full customer roster to anon — confirmed liveDone Add in-product Report link on the public destination viewerBlocked Contact PATCH was wiping every card field — fixed, PR #164Done NEEDS MATTHEW: GitHub Actions billing wall — all CI is blockedDone Apply the October DB hardening batch (F-1 anon public-destinations read + 5 drafted migrations)To do runs.tactile.to is on the open internet behind only an app passwordTo do Enable Supabase leaked-password protectionTo do Publish security.txt (vulnerability disclosure)Done Confirm sandbox flag unset in productionDone Add CORS middleware to tactile-apiDone Add CSP header on web responsesDone Add HSTS headerDone SAST scanning in CIDone Cookie consent bannerDone Audit log table for sensitive opsDone Add abuse-report endpointDone Document secrets inventoryDone Dependency scanning in CIDone Agent-harness escape strings were shipping in page source — stripped, PR #167Done

Wave

Security & Secrets

v1.0 security hardening + secrets discipline. Agent-run security audit before production cut-over (no third-party pen test for v1.0).

TacTile › Launch TacTile › Foundations › Security & Secrets

20/29 done9 open3 open blockers

Selected taskclear

NEEDS MATTHEW NOW: anon can delete any account — one REVOKE closes it

DoneOwner · met_d2667c2b

delete_account_cascade is SECURITY DEFINER with an explicit anon EXECUTE grant and no caller check. Unauthenticated, unrecoverable account deletion. Live right now.

No dependencies in this wave — nothing gates it, and nothing waits on it.

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**NEEDS MATTHEW NOW: anon can delete any account — one REVOKE closes it** · done

delete_account_cascade is SECURITY DEFINER with an explicit anon EXECUTE grant and no caller check. Unauthenticated, unrecoverable account deletion. Live right now.

Where it sits: TacTile › Launch TacTile › Foundations › Security & Secrets

## The brief on file

DONE 2026-07-30 — applied to production with Matthew's explicit authorisation.

The four destructive SECURITY DEFINER functions are no longer reachable by anon.
Verified immediately after, via has_function_privilege:

  delete_account_cascade(uuid)            anon=false  authenticated=false  service_role=true
  purge_account_analytics(uuid)           anon=false  authenticated=false  service_role=true
  drop_old_analytics_partitions(integer)  anon=false  authenticated=false  service_role=true
  enforce_analytics_retention()           anon=false  authenticated=false  service_role=true

service_role is deliberately preserved — the only legitimate caller,
apps/api/tactile-api/src/routes/account.ts:347, uses the service-role key and passes
session.userId from requireSession(), never a client-supplied id. Self-serve account
deletion is unaffected.

WHAT THIS CLOSED: delete_account_cascade takes one uuid and runs ~20 unconditional DELETEs
keyed only on it, ending with `delete from public.accounts where id = p_account`. It contains
no auth.uid(), no auth.jwt(), no current_setting — it never checked its caller. The anon key
ships embedded in apps/web, apps/web-mobile, iOS and Android, and account UUIDs travel in
query parameters (qr.ts:119-133), so anyone could permanently delete any account against a
database with zero backups. enforce_analytics_retention() needed no UUID at all.

TWO GRANT SHAPES, both covered — this is the part worth remembering.
delete_account_cascade had NO PUBLIC entry; anon held an EXPLICIT grant somebody wrote
deliberately, and it appears in no migration in the repo. The other three carried the
PUBLIC-inheritance no-op instead, where `revoke ... from anon, authenticated` silently does
nothing because both roles inherit the implicit PUBLIC grant. Revoking from `public` alone
would have missed the first; revoking from the named roles alone would have missed the rest.
Always name all three.

Fourteen anon-executable SECURITY DEFINER functions remain — tracked on t_449fbef0, still
blocked on Matthew scoping which legitimately need anon for the public scan path. A blanket
revoke there would take every tag scan down.

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

Security & Secrets

NEEDS MATTHEW NOW: anon can delete any account — one REVOKE closes it