Authenticated accounts
Email/password and optional Google sign-in are handled through Supabase Auth. Protected workspace routes require a validated session.
Security
Protecting the records your business depends on.
Security is an ongoing product responsibility. This page describes the controls currently built into distributor.live and how to report a concern.
Controls in place
What is built in
Row-level data controls
Database access is designed around Supabase row-level security so authenticated operations can be scoped to the relevant user.
Session handling
Server-side routes read the authenticated session from secure same-origin cookies, and middleware refreshes session state.
Browser security headers
The application sends content-security, transport-security, framing, referrer, and permissions headers to reduce common browser risks.
Guarded image uploads
The upload endpoint requires authentication, limits payload size, and keeps the third-party upload key on the server.
Server-only privileged access
Privileged service credentials are isolated in server-only code and are not intended to be included in browser bundles.
Shared responsibility
Your part in keeping the workspace secure.
01
Use a unique password and protect access to your email or Google account.
02
Sign out on shared devices and remove access when a team member should no longer use an account.
03
Check storefront, catalog, and invoice data before sharing it outside your business.
04
Report unexpected access, suspicious messages, or exposed credentials promptly.
Responsible disclosure
Found a vulnerability?
Send a clear description, affected URL or feature, reproduction steps, and the potential impact. Please do not access other people's data, disrupt the service, or publish a live issue before we have had a reasonable chance to investigate.