Security

Every workspace-scoped table is locked down with Postgres row-level security. The app talks to the database as the signed-in user except for a small set of server-only jobs (billing webhooks, crons, inbound mail) that use a service role and still filter by organization id.

Auth cookies are scoped to .brael.app so a login on the marketing site carries into your workspace subdomain. Session refresh happens on every request.

API keys you paste (Hunter, People Data Labs) are stored encrypted and never rendered back in full. Stripe never sees your CRM. Report a vulnerability to mike@hodgen.ai.