Security overview
Small access boundaries, enforced on the server and in the database.
This page describes controls implemented in the current codebase. It is not a certification, audit report, or promise that security incidents are impossible.
Account isolation
Authenticated queries use the server-validated user and PostgreSQL Row Level Security.
Server-only privileges
Worker, email-provider, and administrator secrets are kept outside browser-exposed variables.
Safe cancellation links
Merchant URLs must use HTTPS and match configured official domains before redirecting.
Current architecture
Implemented controls
- Authentication
- Supabase Auth manages email/password sessions. Server queries validate the current user instead of trusting a browser-supplied user ID.
- Chrome extension sessions
- The extension uses a scoped, revocable DueCue session. Privileged endpoints validate both the extension origin and the authenticated session.
- Database
- Owner-scoped tables use Row Level Security. Sensitive worker fields and privileged database functions have narrower grants.
- Reminder delivery
- A protected scheduler invokes the worker. Atomic claims, leases, retry bounds, and deterministic identifiers reduce duplicate processing.
- Administration
- Merchant-directory administration requires server-side membership lookup; a client flag is not an authorization boundary.
- External sites
- The product does not send merchant credentials. Cancellation redirects validate the method, owner, HTTPS URL, and official host again on the server.
Data minimization
Reduced access by product design
DueCue does not continuously watch browsing, request Chrome browsing history, connect to bank accounts, read email, or log in to merchant accounts. The Chrome extension performs bounded extraction only after the user explicitly chooses Track this page. That can include an authenticated account or billing page the user has opened, but it does not give DueCue the user's merchant credentials or permission to keep monitoring the page.
Optional Page Awareness performs limited checks only on sites the user explicitly approves and does not run full extraction or create a record. Passwords, payment-card and CVV fields, banking credentials, hidden fields, and private unrelated form values are intentionally excluded. Notes and optional report reasons are still user-provided content, so users should not place secrets in them.
Contact
Reporting a security concern
Send good-faith vulnerability reports to duecuesupport@gmail.com. Do not include passwords, payment-card data, or merchant credentials.