Production Safety

1. 1

   Define durable database invariants

   Create tables, constraints, grants, RLS policies, RPC functions, and service-role access in migrations instead of relying on runtime assumptions.

   • supabase/migrations/20260426000000_init.sql
2. 2

   Preserve request context

   API and webhook routes carry request ids through logs so failures can be traced across rate limits, provider calls, database writes, and jobs.

   • src/lib/security/webhooks/request.ts
   • src/lib/supabase/proxy.ts
3. 3

   Claim before processing external events

   Webhook handlers verify signatures, store event rows, reject duplicate processed events, and reclaim only stale processing leases.

   • src/lib/security/webhooks/request.ts
   • src/lib/security/webhooks/processing.ts
4. 4

   Protect scheduled work

   Cron services validate CRON_SECRET, reject placeholder values, compare authorization without leaking timing, and rate-limit scheduler calls.

   • src/lib/security/cron-secret.ts
   • src/features/notifications/server/outbox/services/cron.ts
5. 5

   Retry through outbox state

   Workers claim a bounded batch, record success or failure, back off transient errors, and dead-letter rows after repeated failures.

   • src/features/notifications/server/outbox/services/worker.ts

Source: src/lib/security/cron-secret.ts

A configured but obvious placeholder secret is treated the same as a missing secret.

export function readValidatedCronSecret(value: string | undefined = process.env.CRON_SECRET): string | null {
  const secret = value?.trim();
  if (!secret) {
    return null;
  }

  if (PLACEHOLDER_CRON_SECRETS.has(secret.toLowerCase())) {
    return null;
  }

  return secret;
}

Source: src/lib/security/webhooks/processing.ts

A processing row can be retried only after the lease timeout, which protects against duplicate live workers and crashed workers.

const WEBHOOK_PROCESSING_STALE_AFTER_MS = 15 * 60 * 1000;

export function isWebhookProcessingStale(
  processingStartedAt: string | null | undefined,
  nowMs: number = Date.now(),
  staleAfterMs: number = WEBHOOK_PROCESSING_STALE_AFTER_MS,
): boolean {
  if (!processingStartedAt) {
    return true;
  }

  const startedAtMs = Date.parse(processingStartedAt);
  if (!Number.isFinite(startedAtMs)) {
    return true;
  }

  return nowMs - startedAtMs >= staleAfterMs;
}