Security
Implemented application controls
Mahon combines authenticated route protection with organization-scoped database and API access.
Controls present in the codebase
- Middleware redirects unauthenticated requests away from protected application routes.
- Supabase row-level security policies scope CRM tables to organization membership.
- Server routes authenticate users and filter organization-owned records by organization ID.
- Selected AI, email, advisor, chat, and provider routes apply request or usage rate limits.
- Stripe billing webhooks verify signatures before subscription events are processed.
- Developer API keys are stored as hashes and can be revoked by authorized organization roles.
Scope of this statement
These statements describe controls implemented in the application code. They do not claim a third-party certification, completed penetration test, or absolute security.
Responsible disclosure
Report a suspected vulnerability with the affected URL, reproduction steps, expected impact, and relevant evidence.
Email legal@silverowl.dev