Trust & Security
Before authenticated persistence was introduced, the rules below were written into the Phase 2 specification. Every related change since is checked against them. Here is exactly how your account and your data are protected.
The server — not your browser — decides what you can see, on every request.
Beta — read this
Nitor is active beta software. This page describes controls that are implemented and reproducible today: signature-verified sessions, least-privilege API keys, database-enforced row isolation, automated tests, and live-browser checks. Nitor has not been independently audited or certified yet. Independent human security review remains on the path to general availability.
Every protected request is authorized on the server by checking your session's cryptographic signature. Your browser is never trusted to assert who you are.
A single server-side guard runs before any protected page renders and decides whether you're allowed in. There is no client-side check to switch off.
Every user-owned table denies cross-user access by default. Row-level security means you can only ever read or change your own data — enforced by the database itself, not just the app.
Sign-in and reset links can only send you to a page inside Nitor. A destination pointing anywhere else is rejected before you are redirected.
New passwords must be at least 12 characters, and a failed sign-in never reveals whether an email already has an account.
Cloudflare Turnstile guards sign-in, sign-up, and password reset, and each challenge is single-use. Mandatory server-side verification is being finalized.
Privileged keys never reach your browser or the source repository. The browser carries only a low-privilege key, and the database remains the real boundary.
Authenticated habit and log data lives in Supabase behind database-enforced row-level security. Guest data remains local to the browser experience.
Supabase's automated security advisors reported zero findings on 2026-07-18. All four public tables — profiles, quotes, habits, and logs — were confirmed with row-level security enabled.
271
40 test files and 271 tests passed in the integrated workspace.
Claude added 62 focused public-page and route-guard tests, including page contracts, solo-developer voice checks, public allowlisting, and protected-route adversarial cases.
8 Codex-lane tests across 5 files passed, including 4 repository contract tests for field fidelity and query behavior.
7 routes
Seven public routes loaded while signed out without redirect. Footer click-through, heading and landmark structure, and keyboard focus order were checked in the rendered app.
Light and dark theme contrast was measured at a minimum ratio of 4.60:1, meeting WCAG AA for normal text.
Adversarial routing covered prefix escape, raw and percent-encoded path traversal, case variants, and all six protected routes with the ?next destination preserved.
2 reviews
Claude Fable 5 reviewed identity, sessions, route protection, and the live-browser adversarial checks against the integrated app.
The persistence repository and its RLS boundary were independently reviewed with OpenAI Codex, including schema fidelity, ownership isolation, mutation safety, and field round-tripping.
Model-assisted review is not an independent human audit or certification.
Report a vulnerability
If you believe you have found a security issue in Nitor, email Salman Ahmad directly. Every report is read, investigated, and handled before coordinated public disclosure. Please allow a reasonable response window.
s.ahmad0147@gmail.com →