Security

• Web application: hosted on Vercel.
• Database and accounts: Supabase, which provides the Postgres database and sign-in, hosted in a United States region.
• Weather pipeline: a separate, always-on worker server at Hetzner in Germany that writes public model and observation data to the same database. It is not part of the web application.
• Transactional email: Resend, for sign-up confirmation, password reset, invitations and pilot-request notices.
• Browser protections: every page is served with a Content-Security-Policy, frame denial (X-Frame-Options: DENY), nosniff, a strict referrer policy, and HSTS in production.

• Sign-in: email and password through Supabase Auth. New accounts confirm their email address through a link that completes sign-in on this site.
• Two-step verification (optional): an authenticator app (time-based one-time codes) can be added in account settings. Removing it requires a fresh code.
• Organization policy: a team owner can require two-step verification for the team. While the policy is on, team data is available only to sessions that passed the authenticator check.

• Session tokens are stored in HTTP-only cookies, marked Secure in production and SameSite=Lax, so page scripts cannot read them.
• Signing out clears the session cookies on that device. Account settings also offers sign-out of all devices, which asks the authentication provider to revoke the account's sessions; if that cannot be confirmed, the page says so.
• Each request is checked against the signed-in user on the server before data is read or written.

• Row-level security: the database enables Postgres row-level security on the tables that hold account, forecast, team and observation data. Requests from the web application run with the signed-in user's session, and the application code does not use the database service-role key.
• Private by default: a forecast is visible only to its author unless the author shares it with a team. Sharing is set when the forecast is saved and cannot be changed afterwards.
• Roles: each team member is an owner, admin, forecaster or viewer. Owners and admins manage membership and stations; forecasters record decisions; viewers read team material.
• Station assignment: team members see a team's forecasts and shift notes only for stations the team is assigned.
• Team information: shared records show the author's display name, as described in the privacy policy.

• Forecast history: each save is a new record. Earlier saves are kept, so a revision never overwrites the decision it changes.
• Protected verification: baselines and verification results are append-only: the database rejects updates and deletes.
• Shift notes: team shift notes are append-only for signed-in users; the database does not allow them to be edited or deleted.
• Team audit log: invitation, revocation, settings and station-request actions are written to an audit table that owners and admins can read.

Forecast guidance comes from public model output, including NOAA models (HRRR, GFS, NAM and related runs) and ECMWF open data, read through the Herbie retrieval library. Observations come from Iowa Environmental Mesonet ASOS records and Synoptic Data. Each stored value is tagged with its source and model version.

A scheduled job runs a logical database dump (pg_dump, custom format) once a week on the worker server and keeps dumps for 35 days. Dumps are not copied off that server automatically; operators copy them periodically. Restoring a dump requires pg_restore into an empty database.

Email hello@wxlens.net with a description and steps to reproduce. Please do not access other people's data while testing.