Tenant isolation
Organization, workspace, and site membership checks are enforced server-side on protected resources and mutations.
Autonomy is useful only when boundaries hold.
Rankelo combines tenant-scoped authorization, encrypted integration credentials, guarded crawling, explicit approvals, idempotent workers, and audit records. External provider readiness remains separate from application correctness.
Session protection
Server-side sessions use HttpOnly cookies, CSRF tokens, origin controls, expiry, revocation, and rate limits.
Credential handling
Provider secrets are encrypted at rest with a separate runtime key and are not returned through product APIs.
Safe crawling
Private networks, metadata services, unsafe redirects, URL credentials, DNS rebinding patterns, size limits, and timeouts are guarded.
Governed actions
Approval state, before and after values, provider responses, affected resources, and rollback records are persisted.
Reliable background work
Jobs use atomic claims, idempotency keys, bounded retries, stale recovery, and per-type concurrency controls.
Payment security
Entitlements follow verified events.
Rankelo creates checkout sessions through a test-mode-only Razorpay adapter. A checkout or client confirmation cannot grant access by itself. Signed webhooks, event idempotency, event ordering, and terminal states control paid entitlements.
Current boundary
External activation needs customer-owned credentials.
The code can verify the provider contract locally. A real test transaction still requires valid Razorpay test keys, webhook secret, and plan identifiers supplied at deployment.
Operational controls
Designed for a real deployment, not a local-only demo.
PostgreSQL primary runtime
Migration checks, transaction rollback, row-level claim safety, and production smoke tests.
Readiness separation
Liveness, migration state, worker heartbeat, and external credential state can be evaluated independently.
Backup and restore runbook
Deployment readiness requires a verified dump and restore against an isolated database.
Responsible disclosure
View service statusFound a security concern?
Do not include credentials or sensitive customer data in a report. Use the repository security channel configured by the operator.