Security at SpecCore Analytics

Authentication is provided through Supabase with email verification, password recovery, secure session cookies, CAPTCHA support, rate limiting, and role-based administrator controls. Administrative status cannot be self-assigned through public account fields.

Uploaded files are stored in private storage paths tied to the owning user or organization. Row-level security and server-side authorization restrict project, file, extracted specification, usage, and billing records.

SpecCore accepts only supported PDF, XLSX, and CSV inputs within configured size and batch limits. File signatures, extensions, storage paths, duplicate content, processing attempts, and extraction status are validated or recorded for review.

Security-relevant administrator actions, support overrides, processing failures, and report actions are audited. Secrets remain server-side, Stripe webhooks require signed payloads, and production responses avoid exposing internal credentials.

Report a suspected vulnerability to team@speccoreanalytics.com with reproduction details and avoid accessing data that is not yours. We will acknowledge and assess good-faith reports.