Security & PostgreSQL Row-Level Security (RLS)
At GearBox Studio, your proprietary cabinetry designs, client floor plans, and workshop cut-lists are protected by cryptographic isolation at the database engine level.
PostgreSQL Row-Level Security (RLS)
Every database query enforces auth.uid() = user_id directly in the PostgreSQL kernel. No application bug can expose your CAD records to another tenant.
RFC 6238 TOTP 2FA
Hardened multi-factor authentication using standard TOTP algorithms (Google Authenticator, 1Password, YubiKey) protects your workshop account from credential stuffing.
TLS 1.3 & AES-256 Encryption
All CAD streams and vision uploads are encrypted in transit via TLS 1.3 with Perfect Forward Secrecy. Database volumes are encrypted at rest with AES-256.
Scoped Client Review Tokens
Interactive 3D client sharing links (?review=true) are cryptographically signed read-only snapshots that strictly prevent access to your BOM costs or internal CAD prompts.
How PostgreSQL Row-Level Security Protects Your Projects
Unlike conventional SaaS platforms that rely purely on application-level WHERE tenant_id = ? filters in ORM code, GearBox Studio delegates authorization directly to the PostgreSQL database engine via Supabase RLS.
Even if an attacker attempts SQL injection or modifies API payloads, PostgreSQL discards the transaction unless the cryptographic JWT signed by Supabase Auth matches the row owner.
Cryptographic Webhook Verification (Bachs.io)
Billing event synchronization between our payment gateway (Bachs.io) and GearBox Studio uses SHA-256 HMAC signature verification:
- Every webhook request carries a timestamped signature in the
X-Bachs-Signatureheader. - Our backend computes an HMAC digest using a secret key stored in environment variables, rejecting replayed or altered requests.
- Replay attack prevention enforces a strict 5-minute tolerance window on timestamps.
Scoped Client Review Links: Zero Internal Data Leakage
When you send a 3D model to a client or general contractor for dimensional sign-off (?review=true&proj=...):
Responsible Vulnerability Disclosure
We take security seriously and welcome vulnerability reports from security researchers. If you discover a vulnerability, please email our security team directly: