Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Launch TacTile›Foundations›Security & Secrets·29 in this wave

Approve: Security & SecretsTo do · blocker NEEDS MATTHEW: audit every SECURITY DEFINER function for the PUBLIC execute grantTo do · blocker DO NOT RUN: the armed Stripe live-webhook rotation script would leave prod rejecting every webhookBlocked · blocker Per-account rate limiting on write endpointsDone Rate limit auth endpointsDone Agent-run pre-launch security auditDone Rotate all credentials at production cut-overTo do Encrypt card connector tokens — currently plaintextTo do Make the cookie banner actually gate non-essential storageDone NEEDS MATTHEW NOW: anon can delete any account — one REVOKE closes itDone NEEDS MATTHEW: v_account_tier leaks the full customer roster to anon — confirmed liveDone Add in-product Report link on the public destination viewerBlocked Contact PATCH was wiping every card field — fixed, PR #164Done NEEDS MATTHEW: GitHub Actions billing wall — all CI is blockedDone Apply the October DB hardening batch (F-1 anon public-destinations read + 5 drafted migrations)To do runs.tactile.to is on the open internet behind only an app passwordTo do Enable Supabase leaked-password protectionTo do Publish security.txt (vulnerability disclosure)Done Confirm sandbox flag unset in productionDone Add CORS middleware to tactile-apiDone Add CSP header on web responsesDone Add HSTS headerDone SAST scanning in CIDone Cookie consent bannerDone Audit log table for sensitive opsDone Add abuse-report endpointDone Document secrets inventoryDone Dependency scanning in CIDone Agent-harness escape strings were shipping in page source — stripped, PR #167Done

Wave

Security & Secrets

v1.0 security hardening + secrets discipline. Agent-run security audit before production cut-over (no third-party pen test for v1.0).

TacTile › Launch TacTile › Foundations › Security & Secrets

20/29 done9 open3 open blockers

Selected taskclear

Agent-run pre-launch security audit

DoneOwner · Vivt_ff7ce36c

Full agent audit before cut-over: dependency scan, RLS review, auth + rate-limit checks, anon-callable RPC review. No third-party pen test for v1.0.

Waiting on 8 · 1 still openPer-account rate limiting on write endpoints Rate limit auth endpoints Audit log table for sensitive ops Add abuse-report endpoint Document secrets inventory Dependency scanning in CI Enable Supabase leaked-password protection Confirm sandbox flag unset in production

Unlocks 2Rotate all credentials at production cut-over Approve: Security & Secrets

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**Agent-run pre-launch security audit** · done

Full agent audit before cut-over: dependency scan, RLS review, auth + rate-limit checks, anon-callable RPC review. No third-party pen test for v1.0.

Where it sits: TacTile › Launch TacTile › Foundations › Security & Secrets

## Waiting on 8

- Per-account rate limiting on write endpoints — done
- Rate limit auth endpoints — done
- Audit log table for sensitive ops — done
- Add abuse-report endpoint — done
- Document secrets inventory — done
- Dependency scanning in CI — done
- Enable Supabase leaked-password protection — to do
- Confirm sandbox flag unset in production — done

1 of those is still open. If one genuinely blocks this, say so and stop rather than working around it.

## Unlocks 2

- Rotate all credentials at production cut-over
- Approve: Security & Secrets

## The brief on file

[2026-10-08 · Viv] DONE t_ff7ce36c. Pre-launch audit addendum is written and reviewed, not merged, not pushed. Branch r30/security-audit, worktree ~/TacTile-dev/TacTile-security-audit-1009, commits 3b6b3c79 + fixes 042a3c30, 5745b91e; file docs/audit/2026-10-08-prelaunch-audit-addendum.md. Covers: reachability triage of 110 dependency advisories; rate-limit review (public viewer /t/<hash> has no per-visitor limiter, RL-3; form submit RL-1); CORS classification; RLS/auth summary. Open for Matthew: (1) yes/no to drop p_destinations_public_select (F-1: 166 public destinations, 3 Wi-Fi passwords, 4 payment rows readable with the anon key; post-apply steps listed, incl. two runtime RLS tests); (2) runs.tactile.to is open to the internet behind only an app password: Access with One-time PIN recommended; (3) remaining sign-offs in the doc. Nothing applied to prod. Draft PR https://github.com/TacTile-dev/TacTile/pull/734.

[2 Oct 2026 overnight — Viv: premise fixed in part, task stays open: the audit ran as #558 5bfed8f9 (docs/audit/2026-08-26-agent-security-audit.md: authz, secrets, public viewer, Stripe webhook, CORS, RLS, anon RPCs) but it has no dependency scan or rate-limit review, which this task lists, and its sign-off items are still open.]

Viv — run the full pre-launch security audit before cut-over: dependency scan, RLS review, auth + rate-limit checks, and anon-callable RPC review (no third-party pen test for v1.0); surface anything needing Matthew's sign-off.

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

Security & Secrets

Agent-run pre-launch security audit