Security

Access control

Row-level security is enforced on every user and administrative table in the database. Public read access is limited to approved, published records. Owners and agents can only read and modify their own listings and their own leads. Administrative roles are stored separately from user profiles and validated server-side on every request.

Data protection

Verification documents are held in a private bucket and served only through short-lived signed URLs to the uploading user or verification staff. Private user documents are never placed in public storage.

Application security

Server-side input validation, rich-text sanitisation, file type and size validation, rate limiting on authentication, contact and submission endpoints, CSRF protection on server functions, and secure password reset with email verification.

Accountability

Moderation and verification actions are written to an append-only audit log.

Reporting a vulnerability

A monitored security contact address must be configured by the operator before launch. Please do not test against other usersّ accounts or data.