Lesson 6 / 96 min read
The security model
How apps are isolated from each other and from the platform.
Layers of defense
Browser boundary
Sandboxed iframe (never allow-same-origin)Each app on its own subdomainCSP: no outbound connections
Identity
Short-lived signed session tokenThe persistent key never reaches the browserThe signature is verified inside the database
Data
Row-level security (RLS)User data isolated by uidPasswords one-way hashed (bcrypt)
What it protects, what it doesn't
Protects
- One app reaching another app's data
- Generated code exfiltrating data
- One member seeing another's records
Doesn't (by design)
- A staff view gates the interface, not the database
- Not designed for regulated or highly sensitive data
- An owner choosing a weak password
Key takeaways
- Isolation rests on stacked layers, not a single control.
- The persistent identity key never reaches the browser.
- A role gates the interface; anything a member must never read does not belong in a shared collection.
Related topics
Still stuck? Ask the assistant in the corner, or browse the FAQ.