1. HTTPS & SSL

All production traffic uses HTTPS. Vercel provides automatic SSL for dreamwiseagency.co.za when the domain is connected.

All HTTP requests are redirected to HTTPS. Our production site is hosted on Vercel with automatic certificate management.

2. Secrets & API keys

API keys, payment keys, and database credentials are stored in server-side environment variables only — never in frontend code.

Payment keys (Yoco, future PayFast), database credentials, and email API keys are configured in Vercel environment variables or server-side code only.

3. Form security

Client-side validation plus honeypot spam protection now; server-side validation, rate limiting, and CAPTCHA in Phase 4.

• Client-side validation on all contact and project forms
• Honeypot spam protection on public forms
• Server-side validation planned for Phase 4 API routes
• Rate limiting planned: ~10 form submissions per IP per hour

4. Future API rate limiting

API routes: ~10 form submissions per IP per hour; ~60 requests/minute for estimator (Phase 4).

5. Future admin dashboard

Admin dashboard requires Supabase Auth with MFA recommended (Phase 4).

Admin actions (approving client reviews, updating project status, sending quotes) will require authenticated sessions — no public access to admin routes.

6. Future Supabase & Row Level Security

Supabase tables use Row Level Security — clients see only their data (Phase 4).

Client project data, payment status, and scope documents will be stored in Supabase with RLS policies so users can only read and update their own records.

7. Hosting & backups

Production sites are deployed on Vercel with global CDN. Source code is backed up to GitHub. Database backups will follow Supabase best practices when implemented.

8. Reporting security issues

If you discover a security concern related to dreamwiseagency.co.za, email hello@dreamwiseagency.co.za with details. We aim to respond within 2 business days.