Vyral

VYRAL TRUST CENTER

Security is built around boundaries.

The browser provides the interface. Supabase and protected server functions enforce identity, access, moderation and sensitive account actions.

Last reviewed 8 August 2026

Account protection

  • Unique email identity is enforced by Supabase Auth; one email cannot silently create multiple identities.
  • Email confirmation, expiring recovery links and Cloudflare Turnstile protect sensitive authentication flows.
  • Usernames are normalized and must be protected by a unique database constraint.
  • Account deletion requires an emailed, single-use server token and includes a 30-day recovery period.
  • Rate limits reduce automated sign-up, sign-in and verification abuse.

Data and media

Database Row Level Security must restrict each private record to its owner or an authorized server role. Service-role keys, Brevo API keys and administrator rules belong only in server secrets. Public Supabase project keys may appear in the browser because they are designed to work with Row Level Security.

Large videos should use object storage with private upload policies, signed access where appropriate and explicit media retention—not localStorage.

About inspectable source code

Every website sends HTML, CSS and JavaScript to the browser, so visitors can inspect those files. That is normal and cannot be prevented reliably.

Vyral security therefore must never depend on hiding frontend code. Passwords are handled by Supabase Auth, secrets stay in server environment variables, database policies validate access, and privileged actions run in Edge Functions. Minification may make downloads smaller, but it is not a security control.

Reports and moderation

Reports should create a durable server record, preserve an evidence snapshot, issue a case identifier and send a receipt to the reporter. High-impact moderation actions should create an audit entry and support review or appeal. Automated scoring can prioritize work but should not be presented as infallible AI judgment.

Report a security issue

Do not test against other users or access data that is not yours. Send a clear description and reproducible steps to [email protected]. Do not email passwords, live access tokens, private user content or unnecessary personal data.

For account compromise, follow the account recovery guide.