1. Security Architecture & Controls
Mijatovic is designed with fail-closed security boundaries across applications, authentication, database storage, and inference infrastructure.
Database Row Level Security (RLS) policies fail closed. Requests without valid cryptographic session credentials cannot read or modify conversations, messages, or metadata.
2. Account & Session Integrity
Supabase Auth manages user identity and sessions across protected surfaces. Authentication tokens are verified on trusted server boundaries.
Signed HttpOnly cookies with SameSite attributes protect guest and authenticated sessions against client-side script tampering and cross-site request forgery.
3. Data Access & Isolation
User conversations, account records, API keys, and retrieval contexts are strictly isolated by owner.
Direct client connections with unauthenticated roles cannot bypass table policies or access cross-user records.
4. Conversations & Attachments
Conversations are identified by 16-character Base62 locators that require active session authorization to resolve.
The current browser flow supports guest-session-authorized conversations. An end-to-end attachment workflow is not currently available as a general product capability.
5. Developer Credentials & API Keys
API keys are hashed with SHA-256 upon creation and shown once in Platform. Plaintext keys are never stored or recoverable.
Prepared API keys manage credentials in Platform. Public API execution is currently unavailable and prepared keys do not authorize public requests.
6. Infrastructure & Server Secrets
Privileged operations, database service credentials, and model inference tokens remain strictly restricted to server runtimes.
When a required service is unavailable or unconfigured, the application reports the service as unavailable rather than returning a misleading result.
7. Secure Connections & Edge Protection
All network traffic is encrypted in transit using modern TLS across Cloudflare edge services and platform hosts.
Edge rate limiting and security headers protect application surfaces against automated abuse and unauthorized access.
8. Responsible Disclosure
A dedicated security reporting channel and responsible disclosure program are being prepared. In this development phase, security notices are published directly in documentation.