Guardian safety notice · Security
Security Watch
Guardian, authentication, RLS, tenant isolation, secrets, permissions, and protected actions.
Reason: 2 protected actions held by Guardian.
Active cases
1
Urgent
1
Critical or high
Desk theme
Protected security desk and Guardian station
Owner action
Decide 6 Guardian gate(s) waiting on you.
Worker action
1 work order(s) routed here, 0 with a real start proof.
Pulse snapshot · portfolio-snapshot · Stale · 2026-08-06 17:30 UTC — 7 patient(s) have no live feed; those rows read Not connected on purpose.
Guardian Blocked2 protected actions held by Guardian.Little Buddy — what happens in Security?
Guardian guards the dangerous parts: logins, data rules, secrets and publishing.
The hub security gate is red, which means we cannot prove data is separated between customers.
No one has confirmed that any data was actually exposed.
You must decide the gate before anyone touches the policy.
Overview
Change row-level security policy on the KleinHub AI hub database
An incorrect policy can expose one tenant's data to another, or lock every user out of the hub.
Owner decision: Waiting
Pulse snapshot · HUB-RLS gate · Recent · 2026-08-06 17:30 UTC · Known — Gate reported RED in the latest snapshot.
Attach a live mail provider to the Central Mail Office
Provider authorization grants live sending ability and touches customer-visible mail.
Owner decision: Waiting
Mail Office · Not connected · no timestamp · Unknown — No provider feed attached.
Apply pending migrations on the App Builder project
Migrations against a dirty worktree can apply unreviewed schema changes.
Owner decision: Waiting
Pulse snapshot · app-builder · Recent · 2026-08-06 17:30 UTC · Known
Authorize a read-only BuildCommand feed
Feed authorization exposes run and worker metadata to Pulse.
Owner decision: Waiting
BuildCommand · Not connected · no timestamp · Unknown — Feed not attached.
Overview records for the Security Watch: Guardian, authentication, RLS, tenant isolation, secrets, permissions, and protected actions.
Connection state: Stale — read-only snapshot, no live adapter attached.
Owner action: Decide 6 Guardian gate(s) waiting on you.
Worker action: 1 work order(s) routed here, 0 with a real start proof.
Blocks progress: Yes — a Guardian hold is open.
Pulse snapshot · portfolio-snapshot · Stale · 2026-08-06 17:30 UTC — 7 patient(s) have no live feed; those rows read Not connected on purpose.
Read-only view. Pulse never publishes, deploys, migrates or clears a Guardian gate.