Account & authentication
- Sign-in options — Email and password (stored as bcrypt hashes) or Google OAuth via NextAuth. Sessions are HTTP-only cookies managed server-side.
- Password recovery — Security questions (hashed answers) and email-based reset flows. Questions are chosen from a fixed bank at registration to reduce guessable prompts.
- Session isolation — Client-side storage is scoped per signed-in user so switching accounts on a shared device does not leak node data between users.
- API authentication — Server routes verify the session before reading or mutating user data. Treat every API route like a public endpoint — auth is enforced inside the handler.
Data storage
- Supabase (PostgreSQL) — Primary store for shell state, widgets, trackers, subscriptions, integrations, and node tables. Production requires
NEXT_PUBLIC_SUPABASE_URL and a server-only service role key on Vercel. - Row Level Security— RLS policies restrict reads and writes to the authenticated user's rows. Schema changes are reviewed so policies do not silently block legitimate access.
- Merge, not replace — User payloads are patched and upserted. Deploys and UI updates do not reset dashboards to empty defaults when data already exists.
- Browser cache — Some nodes use localStorage as a fast cache with user-scoped keys. Cloud data wins when newer; caches migrate forward when storage keys evolve.
Integrations & OAuth
- Server-side tokens — OAuth access and refresh tokens for Gmail, Slack, Calendar, and other connectors live in
user_integrations. They are never exposed to the browser or client bundles. - OAuth callbacks — Standard redirect flows through
/api/integrations/[provider]/callback. Only requested scopes are stored for each connection. - Disconnect & delete — Users can disconnect apps per node. Account deletion removes persisted rows tied to the user across shell, widgets, and integrations.
HTTP & browser security
Production responses include hardened headers configured in lib/security-headers.ts:
- Content-Security-Policy — limits script, connect, and frame sources
- Strict-Transport-Security (HSTS) — HTTPS enforced in production
- X-Frame-Options, X-Content-Type-Options, Referrer-Policy
- Cross-Origin-Opener-Policy and Cross-Origin-Resource-Policy
- Permissions-Policy — restricts geolocation and payment APIs by default; camera and microphone are allowed on this site for Kitchen pantry scans and EOD screen capture narration
User-generated HTML is sanitized where rendered (DOMPurify) to reduce XSS risk in rich-text surfaces.
Billing & secrets
- Lemon Squeezy handles card data — LifeNode OS does not store full payment numbers. Webhooks update subscription status server-side.
- API keys (Supabase service role, Lemon Squeezy, OAuth client secrets, AI providers) live only in server environment variables — never in
NEXT_PUBLIC_* vars. - Dev-only flags such as plan overrides and fresh-session skips are blocked from production deploy targets.
Monitoring & incident response
Sentry captures client and server errors in production. Operational triage follows: Sentry → Supabase logs → Vercel runtime logs. User-data impact is assessed before any fix that touches persistence or RLS.
Report security concerns through Ticket escalation and mark the issue as security-related so it can be prioritized.
Your responsibilities
- Use a strong, unique password and enable Google sign-in where possible.
- Sign out on shared devices after use.
- Review connected apps periodically and disconnect unused integrations.
- Do not share billable-hours or vault share links publicly unless intended.
See also our Privacy Policy and Terms of Use.