https://catsec.neocities.org/#writeupsSecurity notes from catsechttps://catsec.neocities.org/#writeupshttps://catsec.neocities.org/writeups/forum-lockdownThu, 05 Nov 2026 00:00:00 +0000The catsec forum runs on a static site, so the browser talks straight to a Supabase database using a public key. That key is meant to be seen. Everything depends on the rules inside the database. Every table uses row-level security, and permissions are granted column by column. Signed-in people can insert a title and a body, but they can't choose the author, the time, or whether a post is hidden, because the database fills those in itself. Moderators can change only the hidden flag on a post. They can't rewrite what somebody said. Spam limits live in the database too, not in the page, since anyone can skip page code. Each person's posts are checked one at a time so simultaneous requests can't slip past the limit. Handles get a lookalike check, so `w0xera` and `wOxera` count as the same name. Read more: https://supabase.com/docs/guides/database/postgres/row-level-securityhttps://catsec.neocities.org/#writeupshttps://catsec.neocities.org/writeups/security-txtThu, 05 Nov 2026 00:00:00 +0000If you find a bug on a website, the hard part is often working out who to tell. RFC 9116 solves that with a small file at /.well-known/security.txt that lists a contact address and an expiry date. The expiry date matters, because stale contact details are worse than none. The standard also allows the file to be signed with OpenPGP, so readers can check it came from the site's owner. You can read catsec's here: https://catsec.neocities.org/.well-known/security.txt The standard: https://www.rfc-editor.org/rfc/rfc9116