Security - Streamly

Secrets

Do	Don’t
Store secrets in host/Wrangler secret managers	Commit `.env.local` / `.dev.vars`
Generate strong `TENANT_SECRETS_MASTER_KEY`	Put service role key in `NEXT_PUBLIC_*`
Rotate cron secret if leaked	Bake plugin payment secrets into client bundles

Separate viewer vs operator Supabase cookie jars (lib/supabase/auth-scope.ts). Theme preview requires operator session.

Enable and keep RLS migrations applied (006+). Service role only on the server.

POST /api/internal/jobs/run requires header X-Streamly-Cron-Secret: <STREAMLY_CRON_SECRET>.

Production operator activation verifies Envato purchase codes via ENVATO_PERSONAL_TOKEN. Disable ENABLE_DEMO on real installs.