Authentication and authorization
Supabase Auth identifies users, and row-level security policies restrict profile, job, and media records to the correct account.
Security
CrunchSave is built for private real-estate media workflows, with security controls enforced on the server side.
Bot and abuse protection
Authentication and generation endpoints use CSRF checks, Turnstile verification, and Upstash-backed rate limits to reduce automated abuse.
Private media storage
Agent portraits, room photos, clips, and final videos are stored in private buckets. Download links are signed instead of permanent public URLs.
Worker signatures
The Node worker accepts generation tasks only when signed requests match the configured worker secret and job metadata.
Payment integrity
LemonSqueezy webhooks are signature-verified, payment events are recorded idempotently, and credits are granted according to known plan variants.