Security
Learn about the application controls and managed service providers used to protect account and program data.
CrEATe Meals uses application controls and managed infrastructure to reduce security risk. No online service can guarantee complete security.
Data Encryption
Production traffic uses HTTPS, and managed infrastructure providers apply their own storage and transport controls.
- HTTPS and TLS for production web traffic
- Managed at-rest controls provided by Supabase
- HSTS and other response security headers
- HttpOnly and SameSite cookie settings where applicable
Managed Authentication
Supabase Auth manages account credentials and sessions, with additional application access checks.
- Provider-managed password hashing and sessions
- Rate limiting on authentication endpoints
- Server-side account and route authorization checks
- Session expiration managed by the authentication provider
Access Control
Tenant-scoped data uses database policies and server-side checks to enforce account boundaries.
- Row-Level Security policies on tenant-scoped tables
- Organization, role, and site access checks
- Server-only handling for service-role credentials
- Least-privilege access as a design goal
Input Validation
Sensitive workflows use layered validation and browser security controls as defense in depth.
- Schema validation in supported API workflows
- Parameterized queries through the database client
- Content Security Policy headers as an XSS mitigation
- Outbound URL checks in supported fetch workflows
Managed Infrastructure
Vercel
Hosting, deployment, edge delivery, and platform security features
Managed hosting providerSupabase
Managed PostgreSQL, authentication, and file-storage services
Managed data providerSecurity Standards
These controls are used as defense in depth; they do not constitute a security certification for CreateMeals.
OWASP Top 10
Common web-risk categories considered during implementation and review
Locked Dependencies
Resolved npm dependency versions are recorded in the project lockfile
Security Headers
HSTS, CSP, X-Frame-Options enabled
SameSite Cookies
CSRF protection via cookie policy
Security Questions?
If you have questions about our security practices or need to report a vulnerability, please contact us.
Contact Our Team