Security

Last updated: 2026-07-10

This page describes the security practices AlverHub actually follows today, and how to report a vulnerability if you find one.

Data protection

All traffic is served over HTTPS. Authentication and database access are handled by Supabase, with row-level security policies enforced at the database layer — not just in application code — for every table that stores user data.

Administrative operations use a separate, server-only service role that never reaches the browser; every admin action additionally requires a verified admin account before it runs.

Application security

We set standard hardening headers (strict transport security, X-Frame-Options, X-Content-Type-Options, a restrictive Permissions-Policy) on every response, rate-limit public write endpoints (signups, submissions, reviews) against abuse, and validate input on both the client and server before it reaches the database.

Payments

We never store credit card numbers. Payments are processed by Stripe/PayPal, both PCI-compliant payment processors — AlverHub never sees or handles raw card details.

Reporting a vulnerability

If you believe you've found a security issue, please report it privately rather than filing a public issue or testing it against real user data. Include enough detail to reproduce it (affected URL/endpoint, steps, expected vs. actual behavior). We aim to acknowledge real reports within a few business days.

Please avoid: accessing or modifying data that isn't yours, running automated scanners against production without contacting us first, or any denial-of-service testing.

Contact

Report a vulnerability to hello@alverhub.com.