Security

1. Payment Security

NugWork uses Authorize.net hosted checkout for paid listings and bundles. Customers enter card data on Authorize.net's hosted page, and full payment card numbers, CVV codes, and card expiry dates are never stored on NugWork systems.

This hosted flow is intended for a SAQ-A payment posture. NugWork stores limited transaction metadata needed to confirm and support listings, such as amount, status, transaction identifiers, and card display details provided by the payment processor.

2. Operated Controls

• HTTPS is used for application traffic.
• Supabase Auth manages user authentication and session cookies.
• Supabase row-level security protects database access where configured.
• Private resume storage uses signed URLs for controlled access.
• Admin access uses a secondary signed session cookie in addition to Supabase authentication.
• Rate limiting is applied to selected authentication, payment, and mutation endpoints.

3. Security Limits

No system is perfectly secure, and NugWork cannot promise immunity from unauthorized access or service disruption.

4. Responsible Disclosure

If you discover a security vulnerability, email nugworker@gmail.com with the subject line “Security Vulnerability Report” and enough detail for NugWork to investigate before public disclosure.