Administration and security
Operate users, roles, bans, waitlist state, sessions, notifications, and sensitive boundaries safely.
Administrator surface
The admin page provides:
- overview counts;
- user search;
- role changes;
- ban and unban operations;
- user deletion;
- waitlist status management;
- Discord and Feishu notification tests.
Every admin API calls requireAdmin on the server. Hiding a button is never the authorization boundary.
Self-protection
Administrator routes prevent deleting or banning the current administrator through the same user-management controls. Account settings own self-directed lifecycle changes.
User ownership
File, API-key, activity, billing, and session queries include the current user ID. Identifiers alone are not sufficient authorization.
Secret boundaries
- Keep provider credentials server-only.
- Verify webhook signatures before parsing business data.
- Hash API keys and show raw values once.
- Restrict AWS IAM to SES sending.
- Use separate preview flags and never enable them in production.
Auditability
The activity stream records important product actions. Webhook events and revoked API keys retain metadata for troubleshooting and audit without retaining reusable secrets.
Recommended hardening
Add rate limiting, abuse controls, CAPTCHA where appropriate, structured audit export, and a managed secrets rotation process before serving a high-risk or high-volume product.