Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Launch TacTile›Foundations›Security & Secrets·29 in this wave

Approve: Security & SecretsTo do · blocker NEEDS MATTHEW: audit every SECURITY DEFINER function for the PUBLIC execute grantTo do · blocker DO NOT RUN: the armed Stripe live-webhook rotation script would leave prod rejecting every webhookBlocked · blocker Per-account rate limiting on write endpointsDone Rate limit auth endpointsDone Agent-run pre-launch security auditDone Rotate all credentials at production cut-overTo do Encrypt card connector tokens — currently plaintextTo do Make the cookie banner actually gate non-essential storageDone NEEDS MATTHEW NOW: anon can delete any account — one REVOKE closes itDone NEEDS MATTHEW: v_account_tier leaks the full customer roster to anon — confirmed liveDone Add in-product Report link on the public destination viewerBlocked Contact PATCH was wiping every card field — fixed, PR #164Done NEEDS MATTHEW: GitHub Actions billing wall — all CI is blockedDone Apply the October DB hardening batch (F-1 anon public-destinations read + 5 drafted migrations)To do runs.tactile.to is on the open internet behind only an app passwordTo do Enable Supabase leaked-password protectionTo do Publish security.txt (vulnerability disclosure)Done Confirm sandbox flag unset in productionDone Add CORS middleware to tactile-apiDone Add CSP header on web responsesDone Add HSTS headerDone SAST scanning in CIDone Cookie consent bannerDone Audit log table for sensitive opsDone Add abuse-report endpointDone Document secrets inventoryDone Dependency scanning in CIDone Agent-harness escape strings were shipping in page source — stripped, PR #167Done

Wave

Security & Secrets

v1.0 security hardening + secrets discipline. Agent-run security audit before production cut-over (no third-party pen test for v1.0).

TacTile › Launch TacTile › Foundations › Security & Secrets

20/29 done9 open3 open blockers

Selected taskclear

Add abuse-report endpoint

DoneOwner · Vivt_de4f0c5a

Intake endpoint for abuse reports on user-published destinations; routes to abuse@.

Unlocks 3Agent-run pre-launch security audit Approve: Security & Secrets Add in-product Report link on the public destination viewer

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**Add abuse-report endpoint** · done

Intake endpoint for abuse reports on user-published destinations; routes to abuse@.

Where it sits: TacTile › Launch TacTile › Foundations › Security & Secrets

## Unlocks 3

- Agent-run pre-launch security audit
- Approve: Security & Secrets
- Add in-product Report link on the public destination viewer

## The brief on file

DONE 2026-07-29. Merged to main and pushed (origin/main 1d28b724). Migration APPLIED to prod.

POST /api/abuse/report — unauthenticated intake, writes public.abuse_reports, notifies support@tactile-connect.com with an [ABUSE — severity] subject prefix. Plus GET /api/abuse/categories serving the 13-category taxonomy. 31 tests, full suite 2020 green.

Design decisions, all pinned by tests:
- Anonymous by design; skips the account-keyed limiter, carries its own per-IP window, length caps, and server-derived severity.
- Report persisted BEFORE email — a mail outage loses the notification, never the report; notified_at finds the ones to re-send.
- Unresolvable hashes still stored and the response is identical either way, so the endpoint is not a destination-enumeration oracle.
- abuse_reports deliberately separate from audit_log with no owner-facing RLS policy.

DB state verified in prod (project xtzqmvfhtremtmbzykeq) after apply:
- 18 columns, 5 indexes, RLS on, 3 service-role policies, 0 policies referencing auth.uid()
- anon and authenticated have ZERO table grants — both get "permission denied" before RLS is even consulted, which is stronger than a policy returning no rows. Verified by executing a read as each role.
- prune-abuse-reports cron job scheduled 03:40 UTC
- Supabase security advisors report nothing against this table.

STILL NOT DEPLOYED: the API worker carrying the route has not shipped, so the endpoint is not live yet. The table is ready and waiting for it.

Remaining, tracked separately: t_b3995b85 (in-product Report link) and t_500d6202 (prove the inbox delivers).

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

Security & Secrets

Add abuse-report endpoint