Security
Research material deserves careful handling.
The web application uses server-managed sessions, row-level authorization and request-scoped release constraints.
Authentication
Email and Google sign-in are handled by Supabase Auth. Sessions are stored in secure cookies and refreshed on the server; OAuth secrets are never shipped to the browser.
Data isolation
Row Level Security ensures users can read and create only their own audit requests. Administrative service credentials must remain server-only.
Responsible disclosure
Report a suspected vulnerability to the configured legal or security contact. Do not include sensitive research data in the initial message.