Who can read a row
Every record belongs to an account. Row level security is on for every table, and no policy skips the membership check.
The permission is not something our code has to remember. It comes from your signed-in session, and Postgres decides what you may see on every single query.
What a guest can reach
The guest app holds no credentials and cannot query anything. It asks for one payload, for whichever stay its session names, and it cannot choose which stay that is. There is no identifier for anyone to tamper with.
- A host link carries a 32-byte token, stored only ever as a hash
- The token leaves the address bar the moment it is exchanged
- Repeated guesses at a booking reference are rate limited, then locked
- A wrong reference and a wrong surname return the same message, so the list cannot be enumerated
What an agent is allowed to say in your name
Four checks stand between a guest message and a reply. None of them is a carefully worded instruction to a model.
Incoming messages are treated as data, not instructions. Anything about money, the door, or a legal or medical matter is flagged and never answered automatically.
The answer comes from your guide. It carries the guide entry it was drawn from.
A second check on the way out. It blocks a door code before arrival day, any promise about money, and any booking change.
Every attempt is logged. What came in, what was retrieved, what was drafted, what was sent, and what was blocked.
