Security

By default, we have included the following precautions:

• Supabase (DB) is never accessed on the client and is only accessible throught the API

• The API requires an user's session token which is periodically refreshed

• The API also handles CORS to deny unknown hosts

• Tables have an RLS policy to only allow Anon and Authenticated roles to access data

• Assests are loaded using signed-URLS and expire after a given time

• We only allow 1 email to sign-up to stop abuse from random people

• The Vercel Firewall (if hosting on Vercel) should also handle malicious traffic and DDOS protection

• We gather absolutely no telemetry

• NextJS security headers are also setup

• We've disabled search indexing so the platform won't be visible on search

However, there are still some things to understand:

• We do not encrypt the journal entries. The main reason to allow full-text search to work.

• We do not handle rate-limiting

• We are not responsible for anything that happens (since the whole point of this is that you handle everything)