Least-secret client design
Client applications use an API URL, App ID, and version. Supabase service-role credentials and application server secrets belong only in trusted environments.
Security designed into every request.
EliteAuth separates browser administration from trusted API operations and validates licenses, devices, versions, and sessions before granting access.
Hashed credentials
Server secrets are compared as SHA-256 hashes, and session tokens are stored as hashes instead of plaintext tokens.
Database isolation
Supabase Row Level Security is used for dashboard data so authenticated owners can access only their own applications and licenses.
Runtime revalidation
Session checks verify the application, HWID, session expiry, application state, license state, and license expiry on each request.
Defense in depth
Controls across the full path.
Security depends on the platform and on correct customer integration. Keep privileged credentials server-side, restrict allowed origins, use HTTPS, rotate secrets after exposure, and treat device identifiers as access signals rather than perfect identity.
Browser dashboardAuthenticated owner access + RLS
Worker APIInput validation + trusted environment secrets
License serviceStatus, version, expiry, and HWID enforcement
RuntimeShort-lived session checks
Security contact
Read disclosure policy →Found something that needs attention?
Send technical reports to security@eliteauth.lol. Do not include active secrets in an initial report.