Scope and status
This draft is a limited statement about controls visible in source. It is not a certification, assurance report, penetration-test result, or promise that Roster is free of vulnerabilities.
Controls observed
- Supabase email-and-password authentication with server-side session validation for the current web application.
- Tenant and role concepts with row-level database policies for some newer employee-document and resignation tables.
- A private employee-document bucket with a 10 MB object limit, a MIME allowlist, and short-lived signed download URLs.
- Audit-log records for administrative changes, including actor and request metadata where available.
- The production web origin presented a valid Let's Encrypt certificate and negotiated TLS 1.3 during the 14 July 2026 verification. Baseline browser security headers were absent from the live response; the repository now adds HSTS, anti-framing, MIME-sniffing, referrer, permissions, and opener controls for the next deployment.
Known remediation priorities
The source audit found critical server-function and database authorisation gaps, broad manager access to sensitive records, stored cross-site-scripting exposure in the audit viewer, weak temporary-password handling, persistent attendance data in browser storage, excessive Android permissions, release signing with a debug key, and missing security headers. These findings are tracked in the internal risk and remediation registers.
Vulnerability reporting
Security reports may be sent to admin@infinitysolutions.app. No PGP key is currently published. The authorised scope is limited to good-faith testing of operator-owned Roster web surfaces and accounts or data the researcher owns or has written permission to use. The Administrator owns acknowledgement, triage, status communication, and escalation.
Do not access another person's data, disrupt service, use social engineering, perform destructive or denial-of-service testing, test third-party infrastructure, or disclose sensitive findings publicly before remediation coordination. The operator will not pursue action for accidental, good-faith, in-scope research that follows these rules, promptly reports the issue, stops after confirming it, and does not retain or misuse data; this does not authorise conduct prohibited by law.
Customer responsibilities
Customers must limit administrator access, review role assignments, protect credentials and endpoints, validate imported records, remove departed users, and report suspected compromise through the approved support process. A final shared-responsibility schedule belongs in the customer contract and DPA.