Security

Last updated: July 23, 2026

Draft document. This document describes 428 Museum's practices in general terms and has not yet been reviewed by a lawyer. It should not be treated as definitive legal advice until formally validated.

1. Infrastructure

428 Museum is hosted on Vercel and uses Supabase as its database and authentication provider. All traffic between your browser and the platform travels encrypted over HTTPS.

2. Access control

The Super Admin panel is protected by server-side middleware that verifies the user’s session on every request. If authentication can’t be verified for any reason, access is blocked by default (fail-closed) rather than allowed.

Write access to the public gallery data and other tables is restricted through Row Level Security policies in the database, so only authenticated and authorized users can modify content.

3. Credential handling

API keys and credentials for external services (database, email delivery) are managed through server-side environment variables and are never included directly in source code or exposed to the visitor’s browser.

4. Reporting vulnerabilities

If you find a security vulnerability in 428 Museum, please report it responsibly by writing to admin@428museum.com before disclosing it publicly. We appreciate and value these reports.

5. Changes to this page

We’ll update this page as our security practices evolve.