Security

Security practices and responsible disclosure policy.

Infrastructure

• Authentication — Clerk handles all auth flows with session management, MFA support, and OAuth providers.
• Database — Supabase with row-level security (RLS) on all tables. Service role key is never exposed to the client.
• Rate Limiting — Upstash Redis sliding-window limiters on the public chat and assistant endpoints.

Data Protection

• All connections use HTTPS/TLS.
• Assistant chat conversations are not persisted by this site.

Responsible Disclosure

If you discover a security vulnerability, please report it responsibly to contact@davidpapp.dev. This is a personal portfolio site maintained by one person; reports are handled on a best-effort basis.

Dependencies

npm dependencies are updated and patched on a best-effort basis.