Pre-Production Security and Reliability Hardening
Completed the final staging hardening pass for environment isolation, migration consistency and protected editorial operations.
Read details
- Enforced fail-closed separation between Stripe sandbox and live configuration. Server operations now verify both the configured key mode and the livemode state of prices, customers, checkout sessions, subscriptions and financial events.
- Made the canonical application URL mandatory and HTTPS-only for deployed production environments while retaining narrowly scoped, exact Vercel Preview origins for authentication requests.
- Reconciled the recorded Supabase migration history and added idempotent care-reminder creation, including repeated custom tasks without a template.
- Removed the Branch Preview hostname from database review-evidence logic. Evidence attachment now passes through a server-verified, service-role-only bridge that independently requires the verified actor, staff authorization and AAL2.
- Enabled leaked-password protection in staging Auth and reviewed RLS, private Storage and SECURITY DEFINER exposure. Public read functions remain intentionally limited; mutation paths retain account, staff or service-role checks.
- The final branch commit passed the complete CI workflow, reached a READY Vercel Branch Preview and returned an exact healthy status. Production configuration, data and domains remain unchanged until the separate production target and final Go/No-Go are confirmed.