Security
Tenant isolation, SSRF defense, credential encryption, and GDPR tooling. The architecture in plain terms.
HubSEO audits arbitrary customer URLs and stores third-party credentials. Both facts shape the security architecture.
Multi-tenant isolation
Every customer table has Row-Level Security enabled and forced at the
Postgres layer, including growth projects, business profiles, opportunities,
evidence, interventions, connectors, competitors, snapshots, experiments,
conversion events, organizations, and autonomy settings. Policies scope all
reads and writes to auth.uid() = user_id. Cross-tenant access attempts
return empty results, not errors that leak existence, and the behaviour is
covered by a dedicated tenant-isolation test suite.
SSRF defense
Auditing customer URLs means fetching them, which makes SSRF the primary attack surface. Defense is layered:
- DNS pinning. The target hostname is resolved to IP addresses before
any connection. Private and link-local ranges are refused:
10.0.0.0/8,172.16.0.0/12,192.168.0.0/16, loopback,169.254.0.0/16(cloud metadata services), IPv6 loopback and link-local, and IPv4-mapped IPv6. - Redirect re-validation. Redirects are followed manually and every hop is re-resolved and re-checked against the blocklist. A redirect cannot bounce into an internal address.
- Network isolation. The render and audit containers run on an isolated internal Docker network with no ingress route to the host network.
Credential storage
Third-party credentials: Search Console OAuth refresh tokens, WordPress
application passwords, Shopify access tokens. None are stored in plaintext.
All are encrypted with AES-256-GCM using a 32-byte master key and a fresh
12-byte IV per write, persisted as { key_version, iv, tag, ciphertext }.
Rate limiting and input hygiene
Public endpoints are rate-limited, AI inputs are sanitised before they reach any model, and form spam controls gate public submission routes.
GDPR and account control
Self-serve compliance endpoints, verified by tests:
- Data export · a machine-readable JSON export of all your projects, reports, opportunities, and evidence.
- Account deletion · an atomic cascade deleting all user records, reports, credentials, and the auth entity.
Details and the deletion flow: Data control.