Security model#

Rehearsal assumes a mistake is more likely than an attacker. Its design makes ordinary misconfiguration fail closed before a state-changing operation.

Trust boundaries#

The engine trusts reviewed package code, strict declarations, a verified active baseline, and exact migration bytes. It does not trust ambient environment variables, hosted project state, unknown fields, changed history, incomplete artifacts, or an unverified runtime.

Independent barriers#

loopback-only application and service URLs;
a dedicated unlinked Supabase workdir, or an exactly named and labeled PostgreSQL container and volume;
exact non-overlapping local ports;
a clean child-process environment that omits hosted credentials;
immutable baseline files and checksums;
exact migration-prefix and candidate digests;
local runtime labels used for bounded stop/removal;
PostgreSQL images must already exist locally and are never pulled implicitly;
plain PostgreSQL receives a fresh random password per disposable runtime, retained only in owner-readable ignored runtime files;
successful receipts written only after verification.
separate exact-digest approval for source setup, source retirement, and identity claim;
short-lived source readers limited to reviewed views/columns and deny checks;
externally provisioned readers require canonical view-definition receipts, security_barrier, independent ownership, an exact non-system readable-column surface, no write or role-escalation paths, and database-enforced expiration;
bounded read-only extraction with no raw dump or row-value logging;
exhaustive privacy policy version 2 with an owner-only local pseudonym key;
application children receive only explicit local mappings and stay in an owned process group.
only one state-changing Rehearsal command may own a project at a time; stale locks are recovered after their process exits;
a state-changing command fingerprints its installed Rehearsal package and refuses to continue if that installation changes while the command is running.

No single environment variable or config edit can redirect runtime commands to production. Optional source preparation is a separate boundary and never provides a hosted execution mode.

External source mode verifies access but does not own it. Rehearsal makes no source-side changes and removes only its local credential and receipt. The provider owns early revocation and the database enforces the reviewed short expiration; Rehearsal never reports local cleanup as proof that a provider-owned role was deleted.

Optional update metadata#

The interactive guide offers a default-declined consent choice before any update request. Approved checks use only npm's fixed public HTTPS endpoints for this package's latest and beta metadata, with one shared three-second deadline, a 64 KiB limit per response and no redirects. Stable installations check only latest; preview installations check both so they can discover promotion to a stable release. No project names, paths, credentials, database values or telemetry are sent. npm still receives an ordinary network request, including its originating network address.

Daily reminders require explicit consent and run only when opening the guide. JSON, CI, noninteractive commands and passive inspection do not check. The owner-private ~/.cache/rehearsal/updates-v1.json stores only bounded preference timestamps and a skipped public version, never project data. Disable reminders in the guide or set REHEARSAL_UPDATE_CHECK=off; network/cache failures never block local recovery. REHEARSAL_UPDATE_STATE_DIR may select another absolute owner-private state directory; symlink files/directories, unsafe permissions and oversized state are refused. This selector cannot redirect the network request or authorize an installation. Preference saves use a private exclusive-create updates-v1.lock and compare the previously read state while holding it, so a stale guide cannot overwrite a successfully saved Disable choice. Contention fails immediately; locks are never stolen or removed based on age. Automatic checks stop if that save fails; an explicitly approved one-time check may continue without saving preferences. If an abnormal exit leaves a lock, close other guide sessions and inspect the selected state directory before manually removing only updates-v1.lock. This is an advisory preference lock, not a runtime or cross-project operation lock.

Release availability is not compatibility or successful installation. Stable installations never receive preview suggestions. Preview installations can discover a newer stable release, explicitly labelled as stable; nothing changes channel automatically. Equal/newer or custom/unverified installations are not replaced. The guide only prints an exact update command and exits before installation, preserving the installed-package fingerprint guard. Dependency changes still require the user's separate action and review. Checks never start infrastructure or change a release channel.

Identity providers#

An optional external identity handshake is distinct from database access. Only declared credential names are read from an ignored owner-only file, and the callback must target local Auth. The local account may represent a sanitized production identity, but its session and writes remain local.

Account association is one local transaction. Rehearsal removes a signup-created row only when its complete declared default shape still matches, refuses unrelated local application data, verifies required role references and an optional token hook, and can copy, byte-check, and retire only declared placeholder-owned Storage paths. Immutable audit references may explicitly retain their synthetic historical actor. Rehearsal also refuses to rewrite application paths when copied records refer to files that are absent from local Storage. Existing browser JWTs still require an ordinary refresh or new sign-in.

Remaining responsibilities#

Rehearsal cannot prove that retained data is lawful, a sanitization rule is ethically appropriate, a migration has the intended business meaning, or a real provider flow was observed. Repository owners must review those decisions and protect artifacts. The configuration barriers are not an operating-system firewall.

Report vulnerabilities through the private security form in this repository. A GitHub account is required. Never put credentials, source data or exploit details in an ordinary issue.