Security

Podorax handles account, profile, collaboration, messaging, scheduling, review, notification, and storage data for podcast hosts and creators. Our security approach is built around practical controls: authenticated access, backend-owned database writes, limited public exposure, careful use of service providers, and clear reporting paths for security concerns.

No public security page should reveal sensitive internal details. This page explains the high-level practices users should understand and the steps they can take to protect their own accounts and collaborations.

We prioritize controls that protect real user workflows: signing in, discovering creators, reviewing requests, messaging collaborators, sharing files, and coordinating recordings.

Security decisions are revisited as the product grows and new collaboration features create new risk surfaces.

Please report suspicious security behavior promptly.

Podorax uses Supabase Auth for account authentication. Depending on enabled sign-in options, users may authenticate with email and password, Google login, password reset flows, or other supported methods. Users are responsible for keeping their email accounts and login credentials secure.

Session protection depends on secure authentication, browser hygiene, and careful account use. You should avoid sharing accounts, signing in on untrusted devices, reusing weak passwords, or clicking suspicious links that claim to be Podorax login pages.

• Use a strong, unique password when password sign-in is available.
• Keep your email account secure because password reset flows depend on it.
• Sign out from shared devices.
• Be cautious of messages asking for credentials or payment details.

Podorax uses Supabase for authentication, database, realtime, and storage services. Supabase-hosted infrastructure helps store app records, profile images, message attachments, and collaboration data. Podorax uses backend service-role access for controlled database operations and frontend authenticated clients only where appropriate, such as auth/session and permitted storage flows.

Data protection practices include access controls, role checks, row-level security where applicable, storage policies, backend validation, logging, and separating public marketplace data from private collaboration data. Sensitive internal details are not published here because doing so could weaken security.

Messages are designed for accepted conversation participants. Conversation access is enforced by backend authorization checks, and messaging tools include read state, typing indicators, attachments, blocking, reporting, and preparation workspace records.

Messages are not public profile content. However, Podorax may access conversation records when needed for support, safety, security, legal compliance, abuse investigation, or product operations. Users should avoid sharing passwords, payment details, private keys, or highly sensitive personal information through messages.

If you believe you found a vulnerability, please report it privately through the Contact page and choose a security or legal topic. Include a clear description, affected URL or feature, steps to reproduce, screenshots or logs if safe to share, and your contact information.

Do not exploit the issue, access other users' data, destroy data, interrupt service, perform social engineering, run spam, or publicly disclose details before Podorax has had a reasonable opportunity to review and respond.

Podorax relies on modern cloud and managed service providers to operate the platform. Infrastructure security includes provider-level controls, application validation, access separation, environment configuration, secrets management practices, and monitoring of operational issues.

We keep this section high-level intentionally. Publicly listing internal architecture details, operational procedures, private endpoints, secrets handling, or detection rules could create avoidable risk. As the platform matures, Podorax may publish more formal security documentation.

We review infrastructure choices as product features change. For example, adding storage uploads, realtime messaging, transactional emails, scheduling, and notifications each creates different operational risks. Security work is treated as an ongoing process rather than a one-time launch task.

Podorax currently uses Supabase for authentication, database, realtime, and storage. Podorax uses Resend for transactional email delivery. These providers help operate core features such as sign-in, profile storage, app data, file storage, realtime updates, and email delivery.

Users may also add third-party links, such as podcast platforms, social profiles, websites, recording tools, or meeting links. Those services are outside Podorax control and are governed by their own security and privacy practices.

Security is shared. Podorax can build controls into the platform, but users also make choices that affect account and collaboration safety.

• Use trusted devices and secure networks when managing your account.
• Verify profiles and links before moving a collaboration off platform.
• Do not download unexpected files or open suspicious links from messages.
• Keep meeting links appropriate for the intended participants.
• Report suspicious account activity, phishing, malware, or impersonation quickly.

Security reports should be submitted through the Contact page until a dedicated security inbox is published. Please include enough detail for Podorax to reproduce or understand the issue without accessing unrelated user data.

If your report involves a live exploit, active abuse, exposed secrets, or potential access to user data, say that clearly in the first line so it can be triaged appropriately.