Security

Connection

• The public site is served over HTTPS.
• Browsers receive a Strict-Transport-Security header (two years). It does not include subdomains, so it does not change mail or other hosts on the domain.
• Pages send a Content-Security-Policy, nosniff, a referrer policy, and a permissions policy. Other sites cannot frame this one.

Sign-in

• Accounts use Supabase Auth. The browser keeps the session in local storage and sends it as a bearer token on API calls. Tokens are refreshed while you stay signed in, and each API route checks the token with Supabase rather than trusting an id in the request body.
• We do not set our own cookies. Stripe, Cloudflare Turnstile, and the face-scan provider may set cookies on their own pages. See the Cookie notice.
• Email confirmation is required before API features. Passkeys are an optional extra sign-in method. Password rules are enforced on sign-up and reset.

Data access

• Member data in the database is protected by row-level security. The browser uses the public anon key; it cannot bypass those rules.
• Actions that must work for every active member (follows, post likes, reshares, comments, comment likes, and comment reshares) are checked again on the server. Hidden and removed posts and comments are not returned.
• Service-role credentials stay on the server. They are not in the client bundle.

Payments and identity

• Card payments go through Stripe Checkout and the Stripe billing portal. Full card numbers are not stored in this app.
• The face scan runs on the identity provider's hosted page (Didit, or Stripe Identity when that provider is selected). The provider keeps the ID and face images. This app stores the verification result and a hash used to spot duplicate accounts.

Abuse limits

• Sign-up and the waitlist, checkout, posting, comments, messages, follows, likes, reshares, job search, the assistant, and passkey sign-in are rate limited. Limits fail open if the counter itself errors, so a database hiccup does not lock everyone out.
• Denied, banned, locked, and suspended accounts are blocked on the server, not only in the interface.

Report a problem

Email support@thecollectiveperspective.com with the page, the time, and what you saw. Please don't include passwords or full card numbers.