This document outlines security considerations and best practices for AgentMesh Cloud.

These variables are exposed to the browser and should only contain non-sensitive data:

NEXT_PUBLIC_SUPABASE_URL=https://ghqyxhbyyirveptgwoqm.supabase.co
NEXT_PUBLIC_SUPABASE_ANON_KEY=eyJ... # Anonymous key only

These variables are only available on the server and should never be exposed to the client:

SUPABASE_SERVICE_ROLE_KEY=eyJ... # Service role key
DATABASE_URL=postgresql://... # Database connection string
VERCEL_TOKEN=vercel_... # Vercel deployment token

• No service role keys in client-side code
• No database URLs in client-side code
• No API tokens in client-side code
• All sensitive variables prefixed correctly
• Environment variables validated in CI/CD

All tables have RLS enabled with tenant-based isolation:

-- Example policy for agents table
CREATE POLICY "Users can view agents in their tenant" ON agents
    FOR SELECT USING (tenant_id = auth.jwt() ->> 'tenant_id'::text);

Regular testing ensures policies work correctly:

# Test anonymous access (should be blocked)
node scripts/supabase-policy-smoke/index.js

# Test service role access (should work)
# Test tenant isolation (should be enforced)

• Anonymous users: Limited read access, no write access
• Authenticated users: Tenant-scoped read/write access
• Service role: Full access for server-side operations only

// Client-side auth (browser)
const supabase = createClient(url, anonKey);

// Server-side auth (API routes)
const supabase = createClient(url, serviceKey);

All API routes validate JWT tokens:

const { data: { user }, error } = await supabase.auth.getUser(token);
if (error || !user) {
  return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
}

All data access is scoped to user's tenant:

const { data } = await supabase
  .from('agents')
  .select('*')
  .eq('tenant_id', user.tenant_id);

All API inputs are validated using Zod schemas:

const schema = z.object({
  name: z.string().min(1).max(100),
  description: z.string().optional(),
});

const result = schema.safeParse(requestBody);
if (!result.success) {
  return NextResponse.json({ error: 'Invalid input' }, { status: 400 });
}

API routes implement rate limiting:

// Example rate limiting middleware
const rateLimit = new Map();

export async function middleware(request: NextRequest) {
  const ip = request.ip;
  const now = Date.now();
  const windowMs = 15 * 60 * 1000; // 15 minutes
  const maxRequests = 100;

  if (!rateLimit.has(ip)) {
    rateLimit.set(ip, { count: 1, resetTime: now + windowMs });
  } else {
    const data = rateLimit.get(ip);
    if (now > data.resetTime) {
      data.count = 1;
      data.resetTime = now + windowMs;
    } else {
      data.count++;
      if (data.count > maxRequests) {
        return NextResponse.json({ error: 'Rate limited' }, { status: 429 });
      }
    }
  }
}

Proper CORS headers for API routes:

const corsHeaders = {
  'Access-Control-Allow-Origin': process.env.NODE_ENV === 'production' 
    ? 'https://yourdomain.com' 
    : '*',
  'Access-Control-Allow-Methods': 'GET, POST, PUT, DELETE, OPTIONS',
  'Access-Control-Allow-Headers': 'Content-Type, Authorization',
};

• All secrets stored in GitHub Actions secrets
• No hardcoded credentials in code
• Environment variables validated before deployment
• Automated security scanning in pipeline

• Environment variables configured per environment
• No sensitive data in build logs
• Proper CORS configuration
• HTTPS enforced

• Service role key only used server-side
• RLS policies tested regularly
• Database access logged and monitored
• Regular security updates

• Data encrypted in transit (HTTPS/TLS)
• Data encrypted at rest (Supabase)
• Sensitive fields encrypted in application layer

• Audit logs retained for compliance
• User data can be deleted on request
• Backup data encrypted and secured

• No PII in logs
• User consent for data collection
• GDPR compliance considerations

• Failed authentication attempts
• Unusual access patterns
• Policy violations
• Environment variable leaks

1. Detection: Automated alerts for security events
2. Assessment: Determine severity and impact
3. Containment: Isolate affected systems
4. Eradication: Remove threat and vulnerabilities
5. Recovery: Restore normal operations
6. Lessons Learned: Update security measures

• Database policy violations
• Unauthorized access attempts
• Environment variable exposure
• Suspicious API usage patterns

All significant actions are logged:

await prisma.auditLog.create({
  data: {
    entityType: 'agent',
    entityId: agentId,
    action: 'create',
    userId: user.id,
    tenantId: user.tenantId,
    ipAddress: request.ip,
    userAgent: request.headers.get('user-agent'),
  },
});

• SOC 2 Type II (planned)
• GDPR compliance
• Data residency requirements
• Regular security assessments

• Regular dependency updates
• Security-focused code reviews
• Automated vulnerability scanning
• Secure coding guidelines

• Network segmentation
• Firewall configuration
• Regular security patches
• Access control policies

• Principle of least privilege
• Regular access reviews
• Security training for team
• Incident response procedures

Report security vulnerabilities to: security@agentmesh.com

Contact the security team for questions about:

• Security policies
• Compliance requirements
• Incident response
• Security training

• Monthly security assessments
• Quarterly policy reviews
• Annual penetration testing
• Continuous monitoring