Falcon Flowmira
Technical Documentation

Security Audit Notes

Security Audit Notes

Living log of security-review decisions for Falcon Flowmira. Reviewers should consult this file before re-flagging findings already vetted here.

public.diagram_ops — immutability by design (intentional)

Finding class: Scanner may flag diagram_ops for lacking UPDATE/DELETE policies, or for allowing broad INSERT access.

Status: Not a vulnerability. Behavior is required by the collaboration protocol.

Why the table is append-only

diagram_ops is the operational-transform / CRDT log that powers real-time multi-user editing on the canvas. Every collaborator emits ordered ops (lamport, actor_id, payload) that are broadcast via Supabase Realtime and replayed by peers to converge state. The log has three invariants:

  1. Append-only. Rewriting or deleting a past op would rewrite history for every peer that already applied it, causing permanent divergence and silent data loss on other clients.
  2. Monotonic Lamport ordering. Ops are addressed by (diagram_id, lamport). Mutating a row would break causal ordering guarantees that the replay engine depends on.
  3. Bounded retention, not mutation. Compaction happens through public.prune_diagram_ops() (trigger) and the snapshot_lamport cursor on public.diagrams — old ops below the snapshot are pruned server-side in a SECURITY DEFINER path, not by clients.

Because of this, RLS deliberately grants only INSERT (scoped to the diagram's owner or an authorized collaborator via share token) and SELECT (same scope). No UPDATE or DELETE policy exists, which under RLS means those actions are denied for every non-service role. This is the correct posture — adding a policy would weaken it.

What is protected

  • INSERT policy checks that the caller is the diagram owner or holds a valid, unexpired, non-revoked editor share for the target diagram_id.
  • SELECT policy mirrors that scope so peers can only replay ops for diagrams they can already read.
  • Pruning runs under SECURITY DEFINER inside the database — never from the client — and is bounded by the diagram's snapshot_lamport.

Scanner guidance

If a future scan re-raises "table has no UPDATE/DELETE policy" or "append-only table looks misconfigured" against public.diagram_ops, mark it Ignored — intentional and reference this section. Do NOT add mutating policies to satisfy the linter.

  • Platform owner / admin bypass on entitlements: see get_effective_entitlements, current_plan_code, and diagrams_enforce_free_limits — admins receive unlimited Pro Plus by design and are exempt from Free-tier caps and expiry.
  • BYOK LLM keys are stored AES-256-GCM encrypted in public.llm_providers; never logged, never returned to the client in plaintext.
  • Admin-only tables (owner_signin_logs, audit_logs, support internals) restrict SELECT to public.is_platform_admin(auth.uid()).