Ghostwriter Security & Tenant Isolation

Sonnev Ghostwriter (https://ghostwriter.sonnev.com) is engineered with defense-in-depth controls across its Next.js web application, Cloudflare Workers API, Supabase PostgreSQL database, and Dodo Payments billing integration.

1. Authentication & Multi-Tenant Row-Level Security (RLS)

• - Token Verification: Supabase JWT tokens are verified cryptographically (jose) on every API request.
• PostgreSQL RLS: All workspace tables use the gw_* namespace with PostgreSQL Row-Level Security enabled (ALTER TABLE gw_* ENABLE ROW LEVEL SECURITY).
• Tenant Isolation: Queries are bound to auth.uid() = user_id so cross-tenant access is blocked at the database engine level.
• Service Role Boundaries: Mutations to subscription entitlements, billing quotas, and webhook logs are restricted to backend service role handlers.

2. Billing Webhook Verification & Idempotency

• - Standard Webhooks HMAC: Incoming billing webhooks from Dodo Payments are verified using HMAC-SHA256 (v1,<signature>).
• Replay Window: Requests outside a 300-second (5-minute) timestamp window are rejected.
• Idempotency: Every processed webhook ID is recorded in gw_webhook_events so duplicate deliveries return HTTP 200 without duplicate side effects.

3. Server-Side Request Forgery (SSRF) Defense

• - Outbound URL Validation: Live cited web research (TinyFish) validates all target URLs before fetching.
• Private Network Blocklist: Rejects loopback (127.0.0.1, localhost), RFC 1918 private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), link-local (169.254.169.254), and cloud metadata endpoints (metadata.google.internal).
• Protocol Restriction: Only public https:// URLs without embedded credentials are permitted.

4. Reporting a Vulnerability

Report security findings via https://contact.sonnev.com/security or https://contact.sonnev.com/contact?product=ghostwriter&topic=Security.