Architecture
The public website is pre-rendered static HTML, CSS and JavaScript with no public application server to patch. Cloudflare security headers restrict framing, content sources, permissions and MIME interpretation.
Lead intake
Production leads should pass through a Supabase Edge Function that validates the payload, enforces rate limits, applies bot checks and writes through a service role kept only on the server. The anonymous browser key must never bypass row-level security.
Administrative access
The dashboard uses Supabase Auth. Enable multi-factor authentication for administrators, restrict lead reads to an admin role and review account activity. Never expose the service-role key in browser code or GitHub.
DSC-specific safeguards
We never need an OTP, USB-token PIN or private key. Customers should enter secrets only within official flows and should revoke a certificate promptly if a token is lost or compromise is suspected.
Operational controls
Keep dependencies minimal, enable Cloudflare managed protections, protect the domain account with MFA, use GitHub branch protection and secret scanning, and review Supabase access policies before launch. No website can promise that it is impossible to hack; layered controls and timely monitoring reduce risk.