Security at Invoice-It.

Supabase Auth provides sign-in, sessions and password recovery. Protected operations verify the caller and resource ownership on trusted backend paths.

Row Level Security and ownership checks restrict access to account records. Privileged service credentials remain server-side, outside the browser application.

Public document links grant access to curated document information, not unrestricted workspace records. Protect links you share and use available revocation controls when access is no longer intended.

Strict input validation, bounded requests, rate limits and duplicate handling reduce misuse. Public account-access requests require a server-validated Turnstile check; they do not prove account ownership.