Security & Responsible Disclosure

Meurneoba OS is designed with tenant isolation, role-based access control, an audit trail on mutations, and a data-request flow for deletion and export. These are properties of the code we ship today, tested in CI.

What this means in practice:

• Tenant isolation. Every authenticated route derives villageId from a verified JWT. Cross-tenant identifiers return 404 by design — verified by tests across modules.
• Role-based access. Routes are gated by role guards. Scoped managers (greenhouse, dairy, hospitality, etc.) see only the resources their scope grants. Workers and residents see only what is theirs to act on.
• Secrets handling. Integration credentials live in encrypted form. Webhook secrets are stored as hashes; the plaintext is shown once at creation/rotation. Support tickets reject text that looks like a credential.
• Tokens. Access tokens are in-memory only on the web client. Refresh tokens use an httpOnly cookie. A page reload re-mints the access token from the refresh cookie rather than reading from local storage.
• Audit. Mutations are intercepted and logged. The AI Center surfaces an audit feed of agent decisions and their cost.
• Rate limiting. Auth endpoints and global routes are rate-limited at the application layer.

What we do not currently claim: SOC 2, ISO 27001, HIPAA, or GDPR certification. Production deployments that require any of these should contact us before launch so we can confirm scope.

Database hosting is on Supabase. AI processing currently uses Anthropic models. Weather and FX data come from OpenWeatherMap and the National Bank of Georgia respectively. When you connect a PMS or POS, those providers process data inside their own contracts.

We welcome reports from security researchers. To report a vulnerability:

• Email zuka@meurneoba.com with a clear description, reproduction steps, the affected URL or endpoint, and the potential impact.
• Please give us a reasonable window to fix the issue before public disclosure. We aim to acknowledge reports within five business days.
• Do not access data that is not yours, do not run automated scanners that degrade service for other tenants, and do not exfiltrate data beyond what is necessary to demonstrate the issue.

Good-faith security research conducted under the rules above will not be pursued legally by Meurneoba. We will credit researchers who wish to be credited once a fix has been deployed.

• Reports based purely on missing security headers without a demonstrated impact.
• Denial-of-service attacks, including login-flood attempts against the rate limiter.
• Findings in third-party services we use (Supabase, OpenWeatherMap, Anthropic) that do not affect data inside Meurneoba.
• Vulnerabilities that require physical access to a user's unlocked device.

• An acknowledgement within five business days.
• A triage outcome (accepted, duplicate, out of scope) within ten business days.
• For accepted reports, status updates as the fix progresses and a notice when a fix is deployed.