1. Infrastructure Security and Cloud Isolation
TheCodexThrill application runs on enterprise edge infrastructure backed by Supabase Cloud (AWS, region ap-northeast-2). Communication is secured with TLS 1.3/1.2 enforcing modern cryptographic cipher suites and HTTP Strict Transport Security (HSTS).
Database access utilizes least-privilege service roles with direct SQL table grants revoked from public and anonymous roles. Operations utilize hardened SECURITY DEFINER functions with explicitly pinned search paths to prevent SQL injection and schema confusion attacks.
2. Authentication and Session Management
Authentication sessions are managed via httpOnly, secure, Lax SameSite cookies. Passwords are never stored in application tables and are hashed using bcrypt/argon2 via Supabase Auth. Password recovery links require fresh verification claims and enforce MFA when factors are enrolled.
3. Single Super Admin Invariant
The platform enforces a strict architectural invariant: exactly one active global Super Admin designation exists at every committed state. Successor transfers are atomic, serialized, and require multi-factor verification, preventing administrative lockout or unauthorized privilege escalation.
4. Responsible Vulnerability Disclosure
We take security vulnerabilities seriously and welcome responsible disclosure from security researchers. If you believe you have discovered a security issue affecting TheCodexThrill, please report it immediately:
Security Response Team
Email: security@thecodexthrill.com
PGP/Encrypted Communications: Available upon request.
Please provide detailed reproduction steps and allow adequate time for remediation before any public disclosure. We do not take legal action against researchers acting in good faith.