Muhammad Aziz Taufiqurrahman

Read-only by design

The platform never changes leads, campaigns or sequences in Instantly. A check before every build fails it if the audit code writes to Instantly, posts to Slack or changes a lead's status.

Deny-by-default AI agent

The Slack AI agent only observes by default. Action tools such as data sync are limited to named admins, and that admin list starts empty.

Least-privilege data access

The AI agent reads only through the dashboard API, never the database directly, so every answer follows the same rules as the operator view.

Minimal attack surface

The Slack agent runs in Socket Mode and connects out to Slack, so it needs no public URL or inbound endpoint.

Fail-safe data sync

Deletions never run on an empty or incomplete API response, manual decisions are kept in a history log, and Google workbooks are upgraded in place, never recreated.

Row-level security (RLS)

Tenant isolation enforced inside PostgreSQL: all 65 tables checked, none without RLS, so one business can never read another's data.

Role-based access control

Owner, manager and cashier roles with 19 granular permissions; cost prices never reach cashier sessions.

Attack-based security testing

Forged-JWT tests from an attacker's position found and closed six cross-tenant vulnerabilities.

Tamper-evident audit trail

SHA-256 hash-chained audit logs and append-only ledgers that reject UPDATE and DELETE without exception, including for admins.

Pseudonymisation (HMAC)

Rate-limit, security-event and consent records store keyed hashes, never raw email, IP address or user agent; a test scans every table for the originals.

Secure file access

Uploads are confined to each tenant's own folder; payment proofs sit in a private bucket and open only through 5-minute signed URLs.

Abuse and enumeration protection

Central rate limiting (10 per IP, 30 per email) and identical errors for a wrong password or an unknown account, so accounts cannot be guessed.

Hardened web layer

Security headers including Permissions-Policy, Zod validation of every server input, and the service-role key kept on the server, never in public variables.

Safe releases and recovery

Separate staging and production; every migration passes staging first and reaches production through five gates, with backups and rehearsed restores.