Security model
Authn, authz, secrets, and trust boundaries.
Layers
- Edge / proxy — locale + session gates for
/adminand/app - Better Auth — credentials, OAuth, sessions, 2FA, admin plugin
- Permissions —
auth.access.tsstatements checked in use-cases / safe-action clients - Env — secrets only on server; validated via
platform/env - RSC boundary — never pass secrets or full user rows to client islands
Non-negotiables
- Authenticate inside every server action / use-case — do not rely only on layout guards
- Prefer unguessable IDs; never authorize by email alone
- Impersonation and ban are admin-only permissioned operations
- Rate-limit sensitive endpoints (Redis) when you expose public APIs
Planned hardening
Webhook signature verification (Stripe), org tenancy isolation, Arcjet / bot protection if you enable it.