Security Overview

Security practices inferred from the application architecture—not a certification claim.

• Supabase Auth with JWT sessions
• API keys stored server-side in KV (not in public HTML)
• RLS on user and subscription tables
• HTTPS hosting via Firebase