> ## Documentation Index
> Fetch the complete documentation index at: https://docs.streamly.watch/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

> Security practices for Streamly — secrets, RLS, auth scopes, cron auth, and license activation.

## Secrets

| Do                                             | Don’t                                           |
| ---------------------------------------------- | ----------------------------------------------- |
| Store secrets in host/Wrangler secret managers | Commit `.env.local` / `.dev.vars`               |
| Generate strong `TENANT_SECRETS_MASTER_KEY`    | Put service role key in `NEXT_PUBLIC_*`         |
| Rotate cron secret if leaked                   | Bake plugin payment secrets into client bundles |

## Auth isolation

Separate viewer vs operator Supabase cookie jars (`lib/supabase/auth-scope.ts`). Theme preview requires operator session.

## Database

Enable and keep RLS migrations applied (`006`+). Service role only on the server.

## Cron / jobs

`POST /api/internal/jobs/run` requires header `X-Streamly-Cron-Secret: <STREAMLY_CRON_SECRET>`.

## License

Production operator activation verifies Envato purchase codes via `ENVATO_PERSONAL_TOKEN`. Disable `ENABLE_DEMO` on real installs.

## Related

* [Environment Variables](/technical/environment-variables)
* [Authentication Flow](/authentication/authentication-flow)
* [Roles & Permissions](/authentication/roles-permissions)