Suite security doctrine (Beta-1A). Product boundaries:
VYBZ_MASTERPLAN.md. Archived Music Hub–era notes:docs/archive/pre-suite-2026/SECURITY.md.
- Identity-first — no anonymity; durable creator accounts (email + passkeys).
- Least privilege — RLS on every user table; definer RPCs for privileged writes.
- One Supabase project — never share service_role with the client; never commit secrets.
- Storage-only media origin — private masters in
audio-assets/ repo blobs; public CDN only for approved public assets (site-visuals,media-public, storefront previews). - Honest security marketing — watermark detection is evidentiary, not infallible.
- Human gates — rights claims, contributor disputes, payment method changes, distribution submit, provider upgrades.
VYBZ Desktop (Tauri) and VYBZ for Android (Capacitor) are untrusted clients.
Native packaging does not secure secrets. Privileged actions stay behind RLS,
protected RPCs, Edge Functions, trusted workers, and verified billing webhooks.
No client may ship service_role, Stripe secrets, Resend keys, AI provider keys,
or signing secrets. Platform Bridge must use allowlisted native commands only
(no arbitrary shell / unrestricted FS). See Master Blueprint §16–17.
| Asset | Risks | Controls |
|---|---|---|
| Unreleased audio | Leak, unauthorized download | Sentinel rooms, signed URLs, play/download limits, watermark manifests (Phase 6) |
| Masters / ZIPs | Hotlink, scrape | Private buckets; signed fulfillment only after paid order |
| Credits / splits | Fraudulent claims | Approval workflows; AI may not approve (Phase 3) |
| Payments | Webhook spoof; Connect abuse (tips) | Stripe signature verify; Express for tips only |
| Storefront settlement | Manual payout drift | settlement_status; owner Settle now RPC |
| Bridge/Engine | Remote code abuse | Device registration, signed jobs, sandboxed command templates, no arbitrary shell |
| Desktop native cmds | Path traversal, injection, symlink | Allowlists, path validation, process isolation |
| Local caches | Leak after collaborator removal | Cache purge on access loss; encrypted session stores |
| Deep links | Interception / OAuth abuse | App Links verification; state params; web fallback |
| Update channels | Compromised artifacts | Signed updates; isolated signing keys; checksums |
| Accounts | Session theft | Passkeys preferred; short-lived tokens; platform secure storage |
- Supabase Auth + WebAuthn passkeys (
passkeyEdge Function). - Planned:
organizations/organization_memberswith explicit roles (Phase 1+). - Staff/mod paths remain separate (
/admin,/mod) with existing staff tables.
- Prefer row ownership (
auth.uid()) and membership checks. - Money, tips, watermark events, repo commits: definer-security RPCs.
- Additive migrations must ship RLS + rollback notes.
- Do not treat Bunny CDN/Stream as active origin.
- Watermark embed/detect Edge Functions exist; expand into Sentinel recipient manifests later.
- Provenance / C2PA-related ledger tables remain; extend with signed manifests in Sentinel.
- Stripe Checkout + webhook verification required.
- Storefront packs: platform Checkout (no Connect transfer). Producer paid
off-platform (ACH / Zelle / Vc);
settlement_statustracks manual settle. - Tips / Connect Express: unchanged for creators who complete ID verification.
- Storefront
kind=storefrontfulfillment via Resend signed ZIP (24h). - Cost reservations required before paid AI/mastering jobs (Phase 1 / Commit 4).
- Cost Sentinel (Phase 14): soft monthly USD / free-tier unit caps; kill-switch
via
edge_flags(feature:X:disabled); owner email at ≥ 90% viacost-alertEdge Function. No auto-spend; no client secrets.
- Ruleset (import YAML):
docs/security/cloudflare-ruleset.yml— SPA allowlist + Edge/functions/v1/allow + LFI /__proto__blocks. Name:vybz-cloud-spa-edge· Free-plan expressions usecontains(nomatches/regex). - Ops guide:
docs/security/cloudflare.md - Deploy script:
scripts/deploy-cloudflare-waf.mjs - Ruleset committed: 2026-07-29 (Phase 11 follow-up).
- WAF active: 2026-07-30 (ruleset:
vybz-cloud-spa-edge) · zonevybz.cloud· ruleset idcd57debe6da141c18d4adcaed440c319
Supabase Edge Functions remain the API plane; Cloudflare WAF applies when the hostname is proxied through Cloudflare.
| Secret | Where |
|---|---|
SUPABASE_SERVICE_ROLE_KEY |
Server / Edge / CI only |
| Stripe secret + webhook secret | Edge / webhook only |
RESEND_API_KEY |
Edge only |
FAL_KEY, GROQ_API_KEY |
Edge secrets; never VITE_* |
LIVEKIT_* |
Edge token mint |
COST_ALERT_SECRET, COST_SENTINEL_* |
Edge cost-alert / soft caps; never VITE_* for secrets |
See docs/operations/INCIDENT_RESPONSE.md.
Rotate keys via documented infra commands when those land; until then, Supabase/Vercel/Resend dashboards with dual control.
Define per product in legal drafts (counsel). Engineering default: soft-delete where possible; immutable audit for money, watermark, and distribution events.