Security

VEEMAN handles a sensitive thing — your trading track record — so isolation and authentication are built in from the ground up. This page summarises the posture; for the data-protection view see Your data & privacy.

Authentication

Identity is handled by Supabase Auth (email/password and Google sign-in). Every API request carries a signed JWT, which the backend verifies on each call — by shared secret (HS256) or by Supabase's rotating public keys (JWKS). Audience, issuer and expiry are all mandatory, and the signing algorithm is taken from the key, never from the token itself. Sessions and saved data are keyed to the verified user id; an unverified or malformed request is rejected.

A separate legacy login (a backend-signed cookie from environment credentials) exists only for local development and internal use. It is disabled in production — where Supabase is the sole identity provider — so it offers no extra attack surface online. If it is ever switched back on as an emergency door, it refuses to open with a short secret or password, and a legacy cookie only works for an account configured on the server. The login endpoint is also rate limited (per-IP) to blunt brute-force attempts.

Data isolation

• Uploads are private. The CSVs you upload are processed only to produce your analysis and are never exposed to other users.
• Per-user storage. On the file backend each user has an isolated folder; on Postgres every row is bound to (user_id, kind, name).
• Storage limit. Each library has a size limit, so one account can't fill the database everyone shares (see Settings).
• Roles are enforced by the server. In a shared space, a read-only member is refused any change to the space's objects by the backend itself, whatever the client sends.
• Upload guards. Files are capped in size, rows and columns, and an Excel file is refused if it would expand past 64 MB once opened: .xlsx is compressed, so a tiny file can be huge inside.
• Fair share of the server. Each account can hold a limited amount of trade-level data open in its sessions at once, and run a limited number of requests at the same time, so one account can't exhaust the memory or the workers everyone shares. A save that needs more storage than is left writes nothing at all rather than half a portfolio.
• Encrypted database link. The connection from the backend to the database requires TLS.

Transport

The frontend (Vercel) and backend (Render) are served over HTTPS. Cross-origin access is restricted to the configured frontend origin (CORS). Legacy development cookies are httpOnly and, in production, secure + SameSite.

• Content Security Policy. Every page carries a fresh nonce: only scripts the app itself served can run, and the page may only talk to VEEMAN's own backend and its identity provider. An injected script would have nowhere to send your data.
• Browser hardening headers. HSTS, nosniff, no framing of the app by other sites (X-Frame-Options and frame-ancestors), a strict referrer policy, and camera, microphone and location disabled.
• Abuse limits follow your account. Rate limits on the AI analyst and on invites are tied to your verified identity, not to your IP or token; anonymous limits use the real client address as reported by the edge network, which a client cannot forge.
• No public API map. The interactive API explorer (/docs, /openapi.json) is disabled in production.

Secrets

Sensitive keys — JWT secrets and the Supabase service-role key — live only in backend environment variables, never in the frontend bundle and never in logs. The high-privilege service-role key is used solely for administrative actions like account deletion, and if it's absent that action fails closed rather than degrading silently.

Account control

• Linked providers. You can link or unlink Google to your account from Settings (at least one sign-in method must remain).
• Export. Download a complete archive of your data at any time — see Exporting data.
• Deletion is permanent. Deleting your account removes your Supabase identity first, then purges stored data and any in-memory sessions. It cannot be undone.
• Deletion needs a recent sign-in. Being signed in is not enough: the server asks for a sign-in from the last ten minutes. Email accounts re-enter the password in the dialog; if you sign in with Google, sign out and back in first. A token copied from an open device can't delete your account.
• Spreadsheet-safe exports. A cell of text that starts with =, +, - or @ (for example a strategy name) is written with a leading apostrophe, so Excel shows it as text instead of running it as a formula. Real numbers, negative ones included, are untouched.