Verify accounts and data isolation with real users
Objective
Enable shared community work only after isolation is verified on the hosted system.
Context
Migrations and protected actions are implemented locally. Production account infrastructure needs an explicitly approved dedicated database and provider configuration.
Acceptance criteria
Configure approved database and authentication; test anonymous, two-member and maintainer sessions; demonstrate blocked cross-user edits and role escalation; test revoked sessions, callback origins and rate limits; attach sanitized test evidence.
Dependencies
Dedicated Supabase project approval; harness reviewer assigned.
Repository & issue
No repository issue is linked yet.
Prepare your contribution
Shared claiming opens after member accounts are verified. Read the dependencies, prepare your approach, and arrange independent review before implementation.