Security Guides for Internal Tools
Access control, tenant isolation and the mistakes that leak data: written from building and running an internal tool on Postgres and Supabase.
17 articles
LLM Tool Calling for Internal Assistants: Design Choices
How to give an internal AI assistant tools — reading workspace data with the user's permissions, formatting results for the model, native function calling vs a routing step, limits on how many tools run, and answers that stay inside the data.
IT Asset Management for Small Companies: Keep It Light
A practical IT asset management setup for small companies — what to track, one record per asset, lifecycle states from purchase to disposal, linking assets to people and requests, and the security reasons it matters.
Caching LLM Responses Safely: What to Cache and What Not
Caching LLM answers saves tokens and latency — and can leak one user's data to another if done carelessly. A safe design: cache only answers that are identical for everyone, key on normalized question plus content version, expire, and lock the cache down.
Validate Next.js Server Actions with Zod and Authorize Them
Server Actions are public POST endpoints. How to validate every input with Zod, check authentication and authorization inside each action, return safe errors to forms, and keep secrets and database logic server-only.
Access Request Approval Workflow: A Practical Design
A secure, fast workflow for access requests — what to ask for, who approves (the manager and the data owner), time-limited access, separation of duties, provisioning, and periodic access reviews.
Supabase Security Definer Functions: The Hidden Exposure
In Supabase, public-schema functions are callable over the API — and SECURITY DEFINER ones bypass row-level security. What our audit found in 117 such functions, the real damage paths, and the grants and rules that close them.
How to Reduce Password Reset Tickets (Securely)
Password resets are one of the most repetitive help desk requests. Cut them with self-service reset, fewer passwords (single sign-on), modern password rules from NIST, and a secure verified process for the resets that still reach a human.
AI Agent Actions with Human Confirmation: A Design Pattern
How to let an AI assistant take real actions — create tasks, request leave, book meetings — safely: propose with structured fields, show an editable confirmation card, execute the confirmed values through existing server code, and report the result.
Employee Offboarding Checklist: Removing Access Safely
A step-by-step IT offboarding checklist — timing with HR, disabling sign-in first, transferring ownership, recovering devices, removing SaaS and shared credentials — so former employees don't keep access and nothing important is lost.
Prompt Injection in Internal AI Tools: A Practical Defense
Internal AI assistants read tickets, documents and messages written by other people — which makes prompt injection an internal threat too. How direct and indirect injection work, and the layered defenses that actually limit the damage.
IT Onboarding Checklist for New Employees
A complete IT onboarding checklist — before day one, day one and the first week — covering accounts, devices, access by role, MFA, security basics and how to run it as a repeatable request so nothing depends on memory.
Next.js App Router + Supabase Auth: The SSR Setup That Works
Two clients, a proxy that refreshes the session, getClaims or getUser instead of getSession, and a layout gate — the Supabase SSR auth setup for the Next.js App Router, with the mistakes that cause random logouts and leaks.
Slack and Discord to Tickets (and Back) with Webhooks
Turn chat messages into help desk tickets with signed inbound webhooks, and post ticket updates back to Slack or Discord — with HMAC verification, idempotency, retries with backoff, and SSRF-safe URLs.
Role-Based Access for Internal Tools: A Practical Design
How to design role-based access for an internal tool — a few flat roles, additive grants for special cases, enforcement in the database, and UI that mirrors it — without ending up with a permissions spreadsheet nobody understands.
Row-Level Security vs App-Layer Authorization: Which Wins?
App-layer checks have to be remembered on every route; row-level security is enforced on every query. When each is right, how to combine them, and the performance and testing details that make RLS work in production.
Rate Limiting API Routes Without Redis (Using Postgres)
A per-user rate limiter built in Postgres — a hits table, a sliding window, an advisory lock against races, and a cleanup job — plus per-IP limits for login, and when you really do need Redis.
Enforcing a Freemium Plan Gate in the Database
Why freemium limits — seats, usage meters, Pro-only features — belong in Postgres triggers and functions, how to stop users upgrading themselves, and the race condition that a count-then-insert check hides.