Architecture triage

How exposed is your SaaS architecture?

10 questions covering tenant isolation, RLS, privileged functions, RBAC, API keys and Stripe webhooks.

This is a self-assessment, not a code scan.

The result is based entirely on your answers. Nothing here can verify your implementation — it tells you where to look.

npm run test:hardening

$ what the hardening suite attacks

cross-tenant-isolation.......... attacks tenant boundaries
security-definer-boundaries..... attacks RLS bypass paths
rbac-privilege-escalation....... attacks role changes
anon-auth-boundary.............. attacks unauthenticated access
invitation-lifecycle............ attacks token reuse & races
stripe-webhook-reliability...... attacks retries & ordering
data-integrity.................. attacks owner protections
api-key-validation.............. attacks revoked keys
billing-enforcement............. subscription writes are webhook/service-role only

# these tests ship with B2B SaaS OS —
# they guard 4 real bugs we found in our own app

What gets covered

Tenant isolationSelf-assessed

RLS coverageSelf-assessed

Authorization enforcementSelf-assessed

RBAC / role changesSelf-assessed

Webhook authenticitySelf-assessed

Webhook idempotencySelf-assessed

State synchronizationSelf-assessed

API key revocationSelf-assessed

Invitation race conditionsSelf-assessed

AuditabilitySelf-assessed