SabHaven is a privacy-focused, invite-only file portal. Security reports are welcome and must not be opened as public issues.

Use GitHub private vulnerability reporting when possible. If that is unavailable, email contact@saboreq.xyz.

Only the latest revision of the main branch and the currently deployed production version are supported.

SabHaven treats the browser as untrusted. Authorization is enforced in Supabase Postgres and Storage policies, with narrow Edge Functions used only where privileged server-side operations are required.

Current controls include:

• a private Storage bucket for every object, including publicly listed downloads;
• Postgres and Storage row-level security;
• account ownership checks across the complete folder ancestry chain;
• short-lived signed download URLs;
• invite-only account creation with hashed, expiring, usage-limited invite codes;
• owner, admin, and user roles enforced by server-side database functions;
• service-role credentials restricted to Edge Functions;
• exact production-origin configuration for browser requests;
• a restrictive hosted Content Security Policy, HSTS, frame denial, MIME-sniffing protection, referrer policy, and browser permissions policy;
• versioned Terms acceptance recorded server-side during registration;
• JWT-protected account export and deletion tooling that resolves the authenticated caller server-side;
• metadata reservation before upload, with Storage inserts restricted to matching owner metadata;
• generic public authentication errors to reduce account and invite disclosure;
• authenticated users can read only their own invite-redemption and legal-acceptance history.

SabHaven is not an end-to-end encrypted storage product. The hosting providers and project operators can technically access infrastructure and stored data according to their platform privileges.

The project currently does not provide:

• malware or antivirus scanning;
• automated content moderation (abuse and illegal-content reports are handled through the published reporting channel);
• per-user storage quotas;
• resumable or multipart uploads;
• a complete user-facing audit log;
• built-in CAPTCHA or distributed rate limiting for invite registration;
• independent penetration-test or compliance certification.

Do not use the project for highly regulated, life-critical, or uniquely sensitive information without an independent security review and additional controls.

Include:

1. the affected route, policy, function, or component;
2. clear reproduction steps;
3. the expected and actual result;
4. potential impact;
5. any suggested mitigation.

Please avoid accessing, modifying, or deleting data that does not belong to you. Reasonable time will be taken to validate and fix a report before public disclosure.

Some privileged administration RPCs are intentionally implemented as SECURITY DEFINER functions callable by the authenticated role. Each such function derives the caller from auth.uid() and performs an explicit owner/admin role check before privileged work. Supabase may still report these functions as a generic linter warning because the warning cannot prove the application-specific authorization logic. Treat any future change to these functions as security-sensitive and keep their regression tests current.