SECURITY AND ACCESS · DESIGN v1 · OCT 2026

What Tendrounds can see, and what it can't.

We hold read access to many client databases, so our first design goal is that a compromise of Tendrounds must not turn into write access to yours. This page lists every permission we ask for and every limit we know about. Tendrounds is in early access; this describes how the product is built, and we update it when that changes.

Summary

Supabase platform	Read-only OAuth scopes. No write scope, no Secrets Read.
Supabase database	A read-only role you create and can revoke at any time.
Vercel	Project and deployment status, env var names. Never values.
Production URL	Public HTML and JS. Anon-key row counts, never rows.
Credentials	Encrypted with AWS KMS. The web app can encrypt, only the worker can decrypt.
Backups	Encrypted per workspace, retention-locked, owner download only.

Supabase OAuth scopes

We connect through Supabase's OAuth app flow and request read access to Projects, Database configuration, Storage (bucket settings), Auth configuration and Organizations, plus advisors_read for Supabase's own security advisor.

We don't request Secrets Read, because it would expose your API keys, or any Write scope. Database Write is what allows arbitrary SQL through the Management API, so we never ask for it.

The read-only database role

SQL-level checks and backups use a role you create with Supabase's documented backup-role recipe. The password is generated in the app and shown once.

create role tendrounds_reader login password '<generated in-app, shown once>' bypassrls;
grant pg_read_all_data to tendrounds_reader;
alter role tendrounds_reader set default_transaction_read_only = on;

We test the connection and confirm the role isn't postgres and that read-only is on.

Limits we state openly

The role can read all data. That's what a backup is.
Supabase documents that a session can switch read-only off itself, write to the pg_net queue if pg_net is enabled, and create large objects.
So the worker sets SET SESSION CHARACTERISTICS AS TRANSACTION READ ONLY, runs only an allowlisted set of catalog queries plus pg_dump, and builds no SQL from strings. A CI test fails the build if any check file contains a write statement.
Prefer checks without backups? Use the same role in “checks only” mode and we never schedule a dump.

Vercel integration

Installed with a project allowlist you choose. We read projects, deployments, production domains and environment variable names and targets. We can't read env var values, deploy, or change team settings.

Credential encryption

Every credential is encrypted with one AWS KMS key under an encryption context of your workspace and connection. The web tier's role may only kms:Encrypt. Only the background worker's role may kms:Decrypt, at the moment it runs your round, and CloudTrail logs every decrypt. Secrets never go into task payloads, logs or error messages. Removing a connection deletes its ciphertext immediately.

Backup encryption and retention

Each nightly pg_dump is compressed and encrypted with AES-256-GCM using a fresh data key for your workspace, then stored in a Cloudflare R2 bucket with a retention lock, so it can't be deleted or overwritten early, even by us. Weekly restore tests run in a throwaway Postgres that is deleted after the test. Only workspace owners and admins can download a decrypted dump, through a 15-minute link, and every download is written to your audit log.

What the free scan does

The free scanner opens soon. When it does, it will only scan apps you own or have permission to scan, and only after you verify ownership with a meta tag, a file at /.well-known/tendrounds.txt, a DNS TXT record or the Vercel integration.

It does	Fetch your public HTML and same-origin JS (max 40 files, 15 MB) and look for privileged Supabase keys and third-party secrets.
It does	Send HEAD requests with your public anon key and Prefer: count=exact to count rows in common table names. No GET, so no row data.
It does	Check for public storage buckets, and your TLS certificate and domain registration expiry.
It doesn't	Use any key it finds except the public anon key, and only for counts.
It doesn't	Write anything, follow redirects to private networks, or crawl behind a login.
It doesn't	Store secrets. Anything found is shown masked (first 8, last 4 characters).
Limits	3 scans per email per day, 10 per network per day, 1 per domain per hour. Results are deleted after 30 days.

Reporting a vulnerability

Found a security issue in Tendrounds? Email security@tendrounds.com. We reply within two working days and credit you if you'd like.

Join the agency waitlist →