Publisting takes the security of its platform and its customers' data seriously.
This document is the entry point to our security program and vulnerability
disclosure process. Detailed material lives in docs/security/.
If you believe you've found a security vulnerability, please email security@publisting.net with:
- a description of the issue and its potential impact,
- steps to reproduce (proof-of-concept if possible), and
- any relevant logs, requests, or screenshots.
Please do not open a public GitHub issue for security reports, and please do not access, modify, or exfiltrate data that isn't yours while testing. We aim to acknowledge reports within 2 business days and to provide a remediation timeline after triage. We support coordinated disclosure and will credit reporters who wish to be named.
Scope: publisting.net and its Supabase backend. Out of scope: volumetric
DoS, social engineering, physical attacks, and findings that require a
compromised device or a self-XSS with no cross-user impact.
| Area | Summary |
|---|---|
| Hosting | Frontend on Vercel; database, auth, and edge functions on Supabase (AWS). Both are SOC 2 Type II. |
| Encryption | TLS 1.2+ in transit (HTTPS enforced, HSTS preload); AES-256 at rest (Supabase/AWS). |
| AuthN | Supabase Auth — email/password + Google/Apple OAuth; optional TOTP MFA. |
| AuthZ | PostgreSQL Row-Level Security as the enforcement boundary; role-based admin. |
| Secrets | Server secrets held in Supabase config; only the public anon key ships to the browser; .env is git-ignored. |
| Headers | Strict CSP, HSTS, X-Frame-Options: DENY, nosniff, Referrer-Policy, Permissions-Policy (see vercel.json). |
| SDLC | GitHub PR review, CI gates (typecheck, lint, build, tests, dependency audit, from-scratch migration replay), Dependabot. |
| Monitoring | Application error monitoring (Sentry); database audit logging. |
docs/security/security-overview.md— customer-facing security overview (whitepaper).docs/security/caiq-lite.md— self-assessment answering common vendor-questionnaire domains.docs/security/subprocessors.md— sub-processor inventory and data shared.docs/security/data-flow.md— architecture, data flow, data classification, and retention.docs/security/risk-register.md— tracked findings and remediation roadmap.
Attestation status: Publisting does not yet hold its own SOC 2 / ISO 27001 certification; a SOC 2 Type II effort is planned (see the risk register). Our infrastructure providers are independently certified — see the sub-processor list.