This project is an MVP and should be reviewed before production use.
Do not commit:
.env- Supabase service-role keys
- keys starting with
sb_secret - Gemini or OpenAI API keys
- Apple certificates or provisioning profiles
Only public Expo variables should be used in .env.example.
The database schema includes Row Level Security policies. Before production, verify all policies manually in the Supabase dashboard and test access with multiple users.
Gemini calls are made through Supabase Edge Functions so provider keys are not exposed to the client. Keep this pattern for any future AI provider.
- Review RLS policies.
- Add server-side abuse/rate limits for all expensive endpoints.
- Add privacy policy and terms.
- Add product moderation for shared nutrition data.
- Validate account deletion flow.
- Avoid logging image payloads or personal nutrition data.