Security Policy

Responsible disclosure

If you discover a security vulnerability in GovCheck PH, please report it responsibly before disclosing it publicly. We take all reports seriously and will respond as quickly as possible.

To report a vulnerability, please open a GitHub issue with the label security or email the maintainer directly if the issue is sensitive. Please include:

• A clear description of the vulnerability
• Steps to reproduce
• Potential impact
• Any suggested remediation, if you have one

We ask that you do not publicly disclose the issue until we have had a reasonable time to address it — typically 30 days.

What we protect

• Supabase service key — used only in server-side code and GitHub Actions; never exposed to the client or public
• Ingest secret — a shared secret required to POST monitoring results; prevents unauthorized data injection
• Row-level security (RLS) — all Supabase tables enforce RLS policies; public users can read but not write to monitoring data
• Anonymous fingerprints — derived from a one-way SHA-256 hash; cannot be reversed to recover IP or browser identity

What we do not store

• Passwords — authentication is handled entirely by Supabase (Google OAuth and anonymous sessions)
• Payment information — GovCheck PH is free and collects no payments
• Raw IP addresses or User-Agent strings — only the derived fingerprint is stored
• Government website content — monitoring uses HEAD requests and does not download page content

Infrastructure

• Hosting — Vercel (serverless, HTTPS-only)
• Database — Supabase (PostgreSQL with RLS, no direct DB access from client)
• Auth — Supabase Auth (Google OAuth 2.0 and anonymous sessions)
• Monitoring jobs — GitHub Actions (isolated per-run environments, secrets not logged)
• Source code — publicly auditable on GitHub under MIT license

Scope

The following are in scope for vulnerability reports:

• The GovCheck PH web application (govcheck-ph.vercel.app)
• The monitoring ingest API (/api/monitor/ingest)
• Authentication flows (Google OAuth, anonymous sign-in)
• Report submission and data validation

The following are out of scope:

• Vulnerabilities in the Philippine government websites being monitored — please report those directly to the relevant agencies
• Supabase or Vercel platform-level issues — report those to Supabase or Vercel directly
• Denial-of-service attacks

Open source

GovCheck PH is fully open source. You can review the complete source code, including all server-side validation logic, RLS policies, and API handlers, on GitHub. Security through obscurity is not part of our model — we rely on correct implementation, RLS, and server-side secrets.