Skip to content
Renewable Vision

Security

What protects the data and the site.

Stated from the site’s own configuration and code: how traffic is protected, who can read and write each table, how members sign in, how keys are held, the limits the routes enforce, and how to report a vulnerability.

In transit

Every page and every route carries the same response headers.

  • The site answers over HTTPS only.
  • Strict-Transport-Security tells browsers to use HTTPS for 2 years, on every subdomain, and carries the preload directive.
  • Also sent with every response: X-Content-Type-Options, X-Frame-Options, Referrer-Policy, X-DNS-Prefetch-Control, Permissions-Policy.
  • A Content Security Policy limits scripts, images, frames and connections to the origins the site uses. It currently runs in report-only mode: browsers report what it would block, and nothing is blocked yet.
  • The policy sets 15 directives, among them no plugins, no framing by other sites and forms that post only to this site, and it reports violations to this site.

In the database

Who can read and write each table is decided in the database, not only in the pages.

  • Row-level security is switched on for every table the site’s migrations define, and a test fails the build if a new one is added without it.
  • The site’s own writes go through its server with a service-role key. That key is held on the server and never sent to a browser.
  • Where a table accepts a write from a browser, a row-level policy limits it: a signed-in member writes only their own watchlist and activity rows, and a visitor can add an enquiry but cannot read one.
  • Enquiries, list subscribers, licence and privacy requests and outreach records can be read only by accounts listed as administrators. A member can read their own profile, keys and usage, and nobody else’s.

Signing in

Membership needs a verified email address or mobile number, and a way of signing in that is the member’s own.

  • A one-time code sent to the email address or mobile number verifies it once, and again when a passcode is reset.
  • After that, members sign in with a passcode of 6 to 12 digits, which the sign-in provider stores only as a salted hash.
  • Members can add a passkey instead. The site keeps only the passkey’s public key; the private key stays on the member’s device or in their password manager and is never sent to the site.

API keys

Keys are optional: every public data route answers without one.

  • A key is shown once, when it is created. The site stores a one-way hash of it and its first eight characters, never the key itself.
  • A member can revoke a key at any time; a revoked key is refused within a minute.
  • A free key gives a daily allowance of 5,000 requests and a count of what it has used.

Rate limits

The data API, sign-in and most forms limit how often one address or one account can call them.

  • Per address, without a key, in 10 minutes: 300 requests to the data routes and 240 to search. Every response states the limit in its headers.
  • Per identifier, in 10 minutes: 3 one-time codes and 6 sign-in attempts, with separate limits per address.
  • The data-licence, Expert Panel, subscription and privacy forms accept a few submissions per address in ten minutes, and the licence, Expert Panel and privacy forms carry a hidden field that turns away automated submissions.

Administration

The console behind the site is open only to administrators.

  • Every administrative request is checked against the signed-in account and the database’s own list of administrators.
  • Edits to the published datasets, every tracker import and every change to a privacy request are written to an audit log with the account that made them.
  • Scheduled jobs authenticate with a secret compared in constant time, and a failed data sync emails the owner.

Where the data is held

Three providers hold the platform’s data and serve its traffic. The regions are the ones recorded in the site’s configuration where it records one, and otherwise the ones each provider publishes.

Supabase
The database, sign-in and file storage.The eu-central-1 region, Frankfurt, as recorded in the site’s configuration.
Vercel
Hosting the site and running its server functions.The provider’s regions, as the provider publishes them.
Resend
Sending the site’s email.The provider’s regions, as the provider publishes them.

The privacy policy lists every provider that processes personal data, and what for.

Report a vulnerability

If you find a security weakness in this site, write to contact@renewablevision.com.sa

Please include

  • The page, route or endpoint affected.
  • What you did, step by step, so it can be reproduced.
  • What the weakness lets someone read, change or stop.
  • How to reach you for questions.

Please

  • Test only against your own account and data, and read no more of anyone else’s than you need to show the issue.
  • Do not degrade the service or send automated traffic at volume.
  • Give the company time to fix the issue before you publish it.

The same contact, in the standard machine-readable form: /.well-known/security.txt