Security is an operating boundary.
WhiskerMatch stores public submissions and authenticated shelter or rescue records. The current controls are real, tested, and stated without claiming that any internet service is invulnerable.
A real application with explicit boundaries.
WhiskerMatch is hosted on Vercel and uses Supabase Postgres and private object storage. Provisioned organizations use an authenticated application for animal, applicant, foster, task, note, status, upload, and audit workflows. Controls reduce risk; they do not erase it.
Current architecture
Transport, headers, authentication, isolation, uploads, secrets, and external discovery.
Current architecture
Transport, headers, authentication, isolation, uploads, secrets, and external discovery.
HTTPS in transit
Production traffic is served over HTTPS through Vercel-managed infrastructure and certificates.
Security headers
The application configures transport, content, framing, content-type, and referrer protections to reduce common browser-based attacks.
Server-side authentication
Authenticated access uses signed httpOnly session cookies and server-side checks. Session state includes revocation support rather than relying only on browser visibility.
Organization-scoped access
Private reads and mutations are scoped to the signed-in user's organization. Role and capability checks are enforced server-side, not merely hidden in the interface.
Private uploads
Animal photos and documents are stored in a private Supabase Storage bucket and accessed through controlled, time-limited links rather than public permanent URLs.
Secrets stay server-side
Database credentials, session secrets, service-role keys, and reset or invitation tokens are not intended for client bundles or source control.
External discovery fails closed
The RescueGroups key stays in the server-only adapter. Responses are runtime-validated and minimized; public media is limited to HTTPS RescueGroups hosts. Missing credentials, timeouts, invalid responses, and stale records do not trigger a fixture substitution.
Account and recovery controls
Core workflows do not depend on automated email. Invitations and password resets can use manually copied, expiring links.
Account and recovery controls
Core workflows do not depend on automated email. Invitations and password resets can use manually copied, expiring links.
Role-based permissions
Organization owners control team access. Capabilities limit which users may perform sensitive administrative and operational actions.
Invitation links
Invitations are represented by controlled links that can be copied and delivered manually. The link must be protected like a credential until accepted or expired.
Password-reset links
Password recovery can produce a controlled reset link for manual delivery. Reset tokens are sensitive and must not be logged, published, or shared with unauthorized people.
Audit records
Material workflow and administrative events are recorded to support accountability and investigation. Audit records reduce ambiguity; they do not replace organizational supervision.
Verification and isolation
Automated tests cover authentication, permissions, organization isolation, invitations, recovery, uploads, and private routes.
Verification and isolation
Automated tests cover authentication, permissions, organization isolation, invitations, recovery, uploads, and private routes.
Organization isolation
Tests exercise cross-organization boundaries and scoped mutations so a user cannot rely on guessed identifiers to access another tenant's records.
Private-route indexing controls
Authenticated, invitation, and password-reset surfaces are marked or routed to avoid normal search indexing.
Input and abuse controls
Public and authentication surfaces use validation and rate-limiting controls appropriate to the current pilot stage.
Environment separation
Local test work is expected to use an isolated database identity. Production migration commands must not run with invalid or unverified credentials.
Limits and responsibilities
WhiskerMatch does not claim absolute security, SOC 2 certification, HIPAA compliance, GDPR certification, bank-grade security, or attorney review. Shelters and rescues remain responsible for user access, record quality, and the information they choose to collect, upload, retain, or publish.
Limits and responsibilities
WhiskerMatch does not claim absolute security, SOC 2 certification, HIPAA compliance, GDPR certification, bank-grade security, or attorney review. Shelters and rescues remain responsible for user access, record quality, and the information they choose to collect, upload, retain, or publish.
No outcome guarantee
Security controls do not guarantee adoption, foster, placement, medical, behavioral, or emergency outcomes.
No professional or emergency service
WhiskerMatch is not veterinary care, legal advice, medical care, behavioral diagnosis, crisis response, or an emergency channel.
Access must be managed
Organizations must remove access when roles change, protect copied invitation and reset links, and report suspected compromise promptly.
Security evolves
The control set will be revised as usage, integrations, data sensitivity, and operational risk change.
Report a suspected security issue
Send a clear description, the affected route, reproduction steps, and potential impact.
Report a suspected security issue
Send a clear description, the affected route, reproduction steps, and potential impact.
Write to support@whiskermatch.com. Do not include unnecessary personal, applicant, animal, or credential data in the report.
Questions about the current security posture?
Ask for specifics. We will distinguish implemented controls, tested behavior, known limitations, and future work.