Security
Security & responsible disclosure.
TechStack builds and operates production software for its own products (Callisto Bridge, Revenue IQ, Retention IQ, LoRadar) and for consulting clients. This page describes how we handle security across both, and how to report a vulnerability if you find one.
Infrastructure
Hosting, transport, edge.
techstackconsulting.io is served from a hardened nginx container on a Hostinger VPS, behind an nginx-proxy layer that terminates TLS with Let's Encrypt certificates. HTTPS is enforced for every request; HSTS is set for one year and applies to every subdomain. Response headers include X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin, X-Frame-Options: SAMEORIGIN, and a restrictive Permissions-Policy that blocks camera, microphone, geolocation, and payment APIs the site does not use.
Applications
Data, auth, tenancy.
Applications we build for clients — and our own products — are built on Postgres via Supabase with Row-Level Security (RLS) policies enforcing per-tenant isolation at the database layer, not just the application layer. Authentication is Supabase Auth with role-scoped access; service-role keys never touch the browser. Every meaningful write is audit-logged with timestamp and actor.
- →Data encrypted in transit (TLS 1.3) and at rest (Supabase Postgres).
- →Per-client isolation enforced via RLS policies audited before production release.
- →Secrets managed via platform environment variables — never committed to source control.
- →Third-party libraries pinned; automated dependency alerts reviewed on a monthly cadence.
Ownership
Client code, client credentials.
For consulting engagements, the source code, database, hosting accounts, and third-party platform accounts all belong to the client. TechStack does not retain sole access to anything a client depends on. At project close, we hand off documented credentials inside the client's own password manager and remove our own access on request.
Disclosure
Reporting a vulnerability.
If you believe you have found a security issue in techstackconsulting.io, in a product we operate (Callisto Bridge, Revenue IQ, Retention IQ, LoRadar), or in a client app we built, please report it privately. We investigate every legitimate report and will acknowledge receipt within two business days.
CONTACT
Please include: the affected URL or product, a short description of the issue, steps to reproduce, and — if relevant — the impact you believe it has. Do not test against other people's data, and do not disclose publicly before we've had a chance to remediate.