Security

A client portal opens without a login. That makes what sits behind it more important, not less. This page describes what actually protects the files you put into BrandLocker.

Files are never public

The storage bucket is private. It is not a public folder with hard-to-guess names in it, and it cannot be listed.

Every download is served through a short-lived signed URL, generated on the server for that one request. A URL that leaks stops working shortly afterwards, and there is no address that returns an index of what else is in there.

The portal link

Each brand kit gets its own hard-to-guess token. Sending that link is how a client gets in, which is the point, so the controls are about what you can do afterwards:

• Unpublish and the link stops resolving immediately.
• Regenerate and the old link retires while the new one carries on, which is what you want once a link has been forwarded further than you intended.
• Set a password on any portal that needs one.

Portals also tell search engines not to index them, and specifically not to index their images, so a link pasted somewhere public does not turn into a search result.

Passwords we cannot read

A portal password is stored as a salted scrypt hash. The app checks a password against the hash and cannot recover the original, including for itself.

That is the right trade and it has a consequence worth knowing: a forgotten portal password is set again, not looked up.

Studios cannot see each other

Every read and write from a studio dashboard goes through row-level security in Postgres, scoped to that studio's own organisation. The isolation is enforced by the database, not only by the screen in front of it.

The public portal deliberately has no anonymous database access at all. It is served entirely by trusted server code that checks the share token and the published flag itself, rather than by opening those tables up to unauthenticated reads.

Accounts

Sign-up, sign-in and password changes can sit behind Cloudflare Turnstile, which stops the scripted sign-ups that otherwise accumulate as empty studios. Email confirmation is handled by Supabase Auth.

Reporting something

If you believe you have found a security problem, please get in touch rather than filing it publicly. There is a Feedback button in every studio dashboard and in the sidebar of every client portal, and anything sent through it reaches the people who run the platform. You can also email info@brandlocker.app.