Security Overview

CapRadar is built around tenant isolation, auditable source evidence, fail-closed billing entitlements, and controlled provider access. This page summarizes the safeguards used to protect customer workspaces.

Tenant Isolation

Workspace data is protected by Supabase Row Level Security. Customer-facing tables use authenticated policies scoped to organization membership, while operational ledgers remain service-role-only.

Authentication

CapRadar uses email-and-password authentication with email confirmation, password recovery, and one-time links as a secondary access path. Protected app routes and state-changing endpoints re-check authenticated identity and workspace role on the server.

Browser Protections

Production responses use a nonce-based Content Security Policy, clickjacking defenses, MIME-sniffing protection, referrer controls, permissions restrictions, and framework fingerprint suppression.

Abuse Controls

Sensitive POST routes have application-level rate limits, with selected high-traffic routes also covered by Vercel Firewall rules. Billing, memo export, outreach export, sign-in, and parsing flows are designed to fail closed when required guards are unavailable.

Vendor Access

Vendor integrations are wrapped with request auditing, HTTPS host and path allowlists, and fail-closed provider controls. Provider-backed workflows are limited to applicable provider terms, customer-authorized use cases, and outputs that remain traceable to source evidence.

Reporting

Please report suspected security issues to support@capradar.app with a concise description, affected route or workflow, and reproduction steps. Do not include sensitive customer data in the initial report.