Security design

Skillerious uses Supabase Auth for accounts and PostgreSQL Row Level Security for data access. Admin/editor permissions are checked in the database, not by hiding buttons. Never place Supabase secret/service-role keys, payment secrets or database passwords in browser files. Achievement issuance is designed to run through a server-side Edge Function. Enable email confirmation, MFA for administrators, rate limits and bot protection before public launch.