Strong security, end to end.

Production baseline for the BREEZE application architecture.

Authentication

Supabase Auth handles customer identity. Privileged operations happen through Cloudflare Pages Functions using server-side credentials.

Authorization

Use role-based authorization for customer, admin, and super-admin roles. Enforce row-level security in Supabase for customer-owned data.

Secrets

Never expose the Supabase service-role key in browser JavaScript. Store secrets as Cloudflare deployment secrets.

API controls

Validate every request, use parameterized queries, restrict CORS, add rate limits to authentication and sensitive endpoints, and return safe errors.

Auditability

Record sensitive admin actions including payment status changes, order changes, package changes, and security-setting changes.