---
type: Security Constraint
title: Authorization and secrets
description: Database RLS enforces access and external API secrets remain server-side.
tags: [security, rls, secrets, supabase]
visibility: public
---

# Authorization boundary

Postgres RLS policies enforce access to maps, sources, channels, and related
records. Client code may hide or disable actions for usability, but it must not
be the only authorization check.

# Required verification

Every new or changed RLS policy requires database tests covering the relevant
owner, editor, viewer, anonymous, administrator, and service-role boundaries.

# Secrets

External API secrets are available only to server-side workers and Edge
Functions. They must not enter browser configuration, generated artifacts,
logs, map recipes, or this knowledge bundle.