Public quote hardening
Public quote pages validate active links, expected forms, consent, hidden fields, submit timing, and abuse signals before accepting synthetic or pilot submissions.
SECURITY
Practical safeguards. Clear boundaries.
See the current access, isolation, logging, and operational boundaries without unsupported compliance claims.
Last updated: July 17, 2026
Security posture
Security boundaries before real pilot data.
BizPilot treats public quote intake as a sensitive surface. The workflow is designed to keep access scoped, secrets out of source, and final customer messages under business control.
Local-only dashboard QA
Authenticated dashboard smoke is local-only because it creates synthetic users, businesses, leads, and source metadata. It must fail fast against managed/non-local Supabase projects and production URLs.
Tenant isolation
Business data access is controlled through authenticated membership, lifecycle status, and database row-level security. Service-role helpers must stay server-only.
AI safety boundary
AI output is a draft aid only. BizPilot must not auto-send, invent prices, confirm bookings, or act as a hidden operator.
Secret handling
Secrets must live in provider environment settings, not source code, logs, screenshots, docs, or commits. Missing keys should fail closed or use documented fallback behavior.
Backup and restore gate
DB-level export/restore proof passed for the synthetic target. Strict restored app/dashboard/RLS proof remains deferred to P1 before paid pilot, production migrations, destructive cleanup, bulk work, or broader scale.
Reference