Security Hardening

Security best practices for production deployments.

Authentication

Always set API_BEARER_TOKEN in production:

API_BEARER_TOKEN=$(openssl rand -base64 32)

All API endpoints require Authorization: Bearer <token> header.

Row Level Security

Run the RLS script after schema setup:

-- scripts/security-rls.sql
 
-- Revoke public access
REVOKE ALL ON ALL TABLES IN SCHEMA public FROM anon, authenticated;
 
-- Enable RLS
ALTER TABLE documents ENABLE ROW LEVEL SECURITY;
ALTER TABLE chunks ENABLE ROW LEVEL SECURITY;
 
-- Deny all for public roles
CREATE POLICY "Deny anon" ON documents FOR ALL TO anon USING (false);
CREATE POLICY "Deny auth" ON documents FOR ALL TO authenticated USING (false);