SECURITY
radar.
How NoLab protects your data across our entire cloud & client software ecosystem.
Edge & Transport Security
All traffic to NoLab services is served over HTTPS via Cloudflare’s global edge network. TLS 1.2+ is enforced, and security headers (HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy) are applied across all responses.
Authentication & SSO
Authentication is handled by Supabase Auth with secure, httpOnly cookies scoped to the .nolab.dev domain. Email verification is required before access is granted, and password hashing follows industry-standard practices (bcrypt).
Data Storage & Privacy
User data is stored in Supabase (PostgreSQL) with Row Level Security enabled. Row-level policies restrict access so users can only read and modify their own data. No credit card data is ever stored on our servers — payments are processed by PCI-DSS compliant providers.
Infrastructure Hardening
NoLab runs on Cloudflare Workers + OpenNext, with functions deployed at the edge. Serverless isolation, WAF rules, and rate limiting protect against common attacks including DDoS, credential stuffing, and injection.
Responsible Disclosure
If you discover a security vulnerability in any NoLab product, please report it privately to security@nolab.dev. We ask that you do not publicly disclose the issue until we have had a reasonable opportunity to address it. We do not operate a public bug bounty at this time.
Global edge SSL, API Gateway authentication tokens, and Postgres row-level security policies are functioning normally.