WTFB handles user accounts, project data, tester reports, and payment events. This page explains the baseline security controls and operational processes we maintain for production use.
Data and access
- Access to private data is limited by server-side checks and Supabase Row Level Security.
- Admin actions must run through server-side role checks and dedicated audit/RPC paths.
- Service role keys must never be exposed in the frontend bundle.
Payments
- Payments are processed through Stripe; sensitive card data is not stored by WTFB.
- Credits are granted only after verified webhook events and idempotent accounting logic.
Monitoring and logs
- Errors and performance are monitored with Sentry/Datadog when user consent is present where required.
- Secrets, tokens, and email-like fields are redacted in structured edge logs before shipping.
Report a security issue
If you find a vulnerability, contact us through support or at [email protected]. Please do not disclose details publicly until we confirm and fix the issue.