Baseline
Security policy
Headers on every response, RBAC on every mutating route, short JWTs, idempotency, PII redaction, no secrets in status.
| Control | Where |
|---|---|
| CSP, frame deny, nosniff, referrer, permissions | backend/shared/golive/security.ts via proxy.ts |
| HSTS | Only when GO_LIVE=true (HTTPS) |
| X-ReserveMesa-Mode | demo | production on every response |
| RBAC | backend/shared/authz/rbac.ts |
| Token bucket | dispatch, auth, ping, payout, SOS |
| Idempotency-Key | trips, holds, unlock, inspections |
| Chat redaction | phones and emails stripped |
| Upload caps | purpose + byte limit + content-type |
Row Level Security already exists on the original Supabase schema. New platform tables ship with Prisma migrations; when you point DATABASE_URL at Supabase, apply supabase/migrations/00003_platform_core.sql or prisma migrate deploy — not both.