Account security
Authentication is handled through Supabase Auth. Users should protect their email account and login credentials, use unique passwords, complete email verification where required, and sign out on shared devices.
Application security
AuctionVerse uses HTTPS, browser security headers, authorization rules, database row-level security, server-side functions for sensitive operations, and restricted provider credentials. Sensitive provider and service-role credentials are not intended to be exposed to browser code.
Operational security
We may monitor errors, suspicious access patterns and abuse, restrict diagnostic endpoints, rotate credentials, patch dependencies, and temporarily disable features where needed to protect the platform.
User responsibilities
- Do not share passwords, recovery links or authentication tokens.
- Do not paste private credentials into team names, league names or public fields.
- Report unexpected account activity promptly.
- Use the responsible disclosure process for security findings.
Incident response
If we confirm a security incident, we may contain affected systems, rotate credentials, preserve relevant logs, correct unauthorized changes, and notify affected users or authorities where required by applicable law.
Report a security concern
Send security reports to arghyaghosh574@gmail.com and follow the Responsible Disclosure Policy.