Database authorization
Supabase tables ship with Row Level Security policies. Anonymous reads are scoped, write paths require an authenticated session, and privileged paths verify operator roles server-side.
Security model
Control planes separated by design.
Identity, data, media, operations, and licensing each have an explicit boundary. The controls ship with Tube; the operator still owns secret management, network policy, and response.
Controlled media delivery
Playback access is issued server-side with short-lived signed URLs, keeping origin paths and privileged storage credentials out of the browser contract.
Role-gated operations
Admin, moderator, and uploader boundaries are checked on the server. Cron and worker endpoints require dedicated bearer credentials rather than browser sessions.
Abuse resistance
Authentication and sensitive mutations are rate-limited. Bulk-import URLs pass SSRF guards, and redirect targets are constrained before navigation.
Audit and drift visibility
Privileged mutations enter the audit trail, while readiness and environment checks surface missing controls before they become silent production drift.
Control inventory
The implemented security surface.
These controls map to shipped application behavior and operational checks rather than a separate security add-on.
- Row Level Security on every Supabase table
- Service-role key segregated server-only
- Signed, short-lived media URLsPlayback access stays server controlled
- CSRF-safe server actions
- Auth rate limitinglib/auth/auth-rate-limit.ts
- Cron bearer authlib/auth/verify-cron-bearer.ts
- Admin role gatelib/auth/require-admin.ts
- Uploader role gatelib/auth/require-uploader.ts
- Safe-redirect guard
- URL guard for bulk imports
- Audit log on all admin mutations
- Env-var audit script
Operator responsibility. Configure secrets, firewall policy, monitoring, backups, and incident response for the environment you run. The operator tooling reference covers that day-two surface.