Account foundation
The Veilpost Supabase project has email/password sign-up enabled with email confirmation required. Production credentials point to the dedicated Veilpost project; customer flow testing is pending.
SECURITY
Privacy should be
built in from day one.
The dedicated Veilpost database and alias allocation are active. Repository changes to the account flow have not been deployed; the email firewall is not operational.
Configured; flow test pending
Alias privacy
Three-word aliases are identifiers, not passwords or authentication secrets.
Customer isolation
RLS is enabled on each application table. Separate authenticated database identities could generate and manage only their own aliases in an isolated rollback test.
Dashboard sessions
Cookie-based session refresh, the confirmation callback and a server-side dashboard gate are implemented in the repository. These code changes await the owner's commit and deployment.
Sender verification
Domain approval must depend on authentication signals, not just the visible From address.
Message handling
Receiving, quarantine storage, forwarding, SPF, DKIM and DMARC evaluation are not yet implemented.
Security descriptions require owner review before public launch.