Security Model
Founder OS v1 is a single-user internal tool. The security model is intentionally simple and appropriate for that context.
What is protected
- Service role key — stored in Vercel env vars only
- Never in GitHub, never in client code
- All API routes are server-side only
- db.json is gitignored — never committed
- Supabase schema revokes public access
What is not yet implemented
- Authentication (deferred — single user)Deferred
- Rate limiting (deferred — internal tool)Deferred
- Audit logging (deferred)Deferred
- Row Level Security (not needed — server-side only)Deferred
Future security (Experience Platform)
- RLS on every learner tablePlanned
- Separate Supabase project for learner dataPlanned
- COPPA / GDPR-K compliance for children's dataPlanned
- Family-scoped access policiesPlanned
- Full auth with Supabase AuthPlanned
The separation between Founder OS and the Experience Platform database is a hard architectural boundary. See the architecture document for full details.