The security layer of the Olyron framework
Secure Raven inspects your Supabase or Postgres database and your public websites with fixed rules, in a fixed order. If your site ships a key that can count your rows, you will see the count, never the rows.
Proof, not a checklist. A stage that cannot finish is reported as incomplete, never as a pass.
WardenDatabase Ravens · policies and grants
SentinelWatch · every 6 hours
ScoutWeb Ravens
Why Secure Raven stands out
Each one is a property of the product you can check for yourself, not a promise about it.
If your site ships a Supabase anon key in its JavaScript, Web Surface finds it and asks your REST API how many rows that key can count. It sends limit=0, discards the response body unread, and keeps only the table name, the status and the count.
GET /rest/v1/<table>?limit=0 → count onlyIn a full database inspection, a stage that cannot finish is reported as incomplete, never as a pass, and the stages after it are skipped.
02 failed → 03 skipped → incompleteAll 13 Ravens are built on fixed rules, and a full inspection always runs Connect, then Static posture, then Detector. No AI model reads your data, and findings, events and credentials are never sent to an AI vendor.
13 Ravens · 3 stages · 0 AI vendorsSecure Raven stores table names, policy names and flags. It never stores your rows.
rows stored: 0A small probe in your own database pushes signed telemetry. Secure Raven keeps a hash of its token and its Ed25519 public key, never your database password.
held: token hash + public keyNo proxy and no WAF sits between you and your users. Shield, if you install it, runs in your own app and database.
proxy: none · WAF: noneHIPAA Hawk cites the Security Rule section for every check, and every privileged action lands in an append-only, hash-chained audit log. Never sold as a certification.
45 CFR 164.312(b) · hash-chainedA machine-readable trust manifest where every certification field is false, and a written list of the claims we do not make.
GET /api/trust/manifest → falseThe leads
Each lead heads a team of Ravens, and every power on the team is a real check that runs in the product today.
RLS Auditor, Storage, Auth, Secrets and Postgres Posture inspect how your database is set up. Then Detector promotes the high and critical events to findings.
HIPAA Hawk is built on the same body. It maps safeguards to Security Rule citations and is not a certification.
Web Headers, Web Surface and Login Flow check your public websites from the outside: security headers, exposed files and keys, and your login page.
The Scout looks from the outside, like a visitor would. It is not a proxy and never sits in your traffic path.
Watch is a scheduled safe inspection of a connected source, every 6 hours by default. The Sentinel also leads the network Ravens and Shield Verify.
Watch is not a firewall, and it is not 24/7 monitoring.
The roster · 13 Ravens
Each check is a hero with its own gear and signature colour. The line on every card is what that Raven checks today, taken from the product registry.
Inspect your Supabase or Postgres database.
Led by the WardenFinds plaintext secret column names (names only, never values) and public anon-key leaks paired with weak RLS.
Cipher limeChecks for an end-of-life Postgres major version, extension updates and insecure settings (SSL, password_encryption, row_security).
Elephant blueMaps technical-safeguard gaps to HIPAA Security Rule citations and tracks vendor BAA inventory gaps. Not a certification.
Clinical cyanCheck your public websites from the outside.
Led by the ScoutFinds exposed files and JS bundles that leak keys (Supabase anon/service_role, Stripe, AWS, GitHub and others).
Lens tealRead telemetry from a probe you run, and record Shield verification.
Led by the SentinelAnalyses telemetry from a probe you run for rogue devices, dangerous open ports and unauthorized hosts. It does not discover your network itself.
Port greenAnalyses probe telemetry for insecure access points, evil twins and WEP or open networks. Not active radio scanning.
Wave skyRecords Shield verification in scan history. It does not claim enforcement by itself.
Seal silverHow an inspection works
A full inspection runs Connect, then Static posture, then Detector. A failed stage skips the stages after it. An incomplete inspection is reported as incomplete, never as a pass.
The probe must answer before anything is judged.
If Connect fails, Static posture and Detector are skipped, and the run is reported as incomplete.
probe answers · or incompleteFive Ravens read how your database is set up.
Tables without row-level security, rules that let anyone write, public buckets, missing MFA, secret-looking column names and an outdated Postgres. Every finding is ranked Critical, High, Medium or Low.
names and flags · never rowsHigh and critical events become findings.
Detector reads the events the probe sent and promotes the high and critical ones to findings, each with its severity. Findings store names and flags, never your rows.
events · findingsincompleteIncomplete. Not a pass. Stage 02 failed, so stage 03 was skipped.
A scheduled safe inspection of one source, every 6 hours by default. While a Watch runs, the Sentinel’s pupil sweeps.
Watch is not a firewall, and it is not 24/7 monitoring.
Sample day at the default interval. The hollow mark is the next run.
Observed from the internet
If your site ships a Supabase anon key in its JavaScript, Web Surface finds it and asks your REST API, with that key, how many rows a table returns. It asks with limit=0, discards the response body unread, and keeps the table name and the count. If a table answers, you get a critical finding.
| Table | Asked for | Answer | Result |
|---|---|---|---|
public.profiles | A row count, limit=0 | 401 · refused | Refused |
public.members | A row count, limit=0 | count 1,204 | ReachableCritical |
public.members · count 1,2040The first table that answers becomes the finding. Inside the database, the RLS Auditor finds the same exposure from your policies instead; the Database Ravens do not run for customers yet.
HIPAA Hawk · for health-tech teams
Technical checks for teams that hold health data. Each one cites the section of the HIPAA Security Rule it relates to, so a reviewer can trace a finding back to the regulation.
technical checks, each citing a Security Rule section. It also tracks gaps in your vendor BAA inventory.
45 CFR 164.312(a)(1)Access Control45 CFR 164.312(b)Audit Controls45 CFR 164.312(c)(1)Integrity45 CFR 164.312(d)Person or Entity Authentication45 CFR 164.312(e)(1)Transmission Security45 CFR 164.308(a)(1)(ii)(A)Risk Analysis45 CFR 164.314(a)(1)Business Associate ContractsHighPublic table has Row Level Security disabled
A scanning aid. Not a certification. No HIPAA certification exists, for us or for anyone else. HIPAA Hawk maps technical safeguards; it does not certify. How HIPAA Hawk maps safeguards
Shield and Evidence
Inspection reports the problem. Shield adds enforcement only if you install it, and every privileged action is written to an audit log.
Enforcement you install: middleware for web requests in Next.js, and database lockdown SQL that you review and approve. It does not sit in your traffic path as a proxy, and it is not a WAF.
| State | What it means |
|---|---|
| Not installed | Nothing is installed yet. |
| Monitoring | Installed, not enforcing. |
| Enforcing | Applying the rules you approved. |
| Degraded | Running, but not fully. |
| Disabled | Turned off. |
| Error | Not working. Needs attention. |
Protected appears only after enforcement is verified.
-- turn on RLS and let owners read only their own rows
alter table public.members enable row level security;
create policy members_owner_read
on public.members for select
using (owner_id = auth.uid());Export a sanitized evidence pack. Every privileged action is written to an append-only, hash-chained audit log that we do not delete. Privileged actions, such as authorizing a scan or turning on Watch or Shield, need MFA with an authenticator app plus a 5-minute step-up.
probe.installprev 8d04…3b · hash 2c7e…91scan.authorizeprev 2c7e…91 · hash 5a19…e0watch.enableprev 5a19…e0 · hash b3f2…47export.createprev b3f2…47 · hash e61c…0dEvidence stamp · Sample
Inspected, which run, which day. Never certified.
Customer API v1 · Ed25519-signed requests · 60 per minute per key · systems, sources, findings, scans
How we secure Secure Raven
What we hold, what we never hold, and the controls that guard it. Each one is live on Secure Raven today. Security at Secure Raven
Held by Secure Raven
Never stored, never sent
RLS · cross-tenant testsRow-level security on every tenant table, with cross-tenant isolation tests.
public key: no grantsThe public key cannot run any database function or read any table. Privileged functions are server-only.
TLS 1.2+ · AES-256In transit: TLS 1.2 or later with HSTS. The app reaches its database only through Supabase’s HTTPS APIs, and the database refuses connections without SSL. At rest: AES-256 on our providers’ disks.
MFA · 5-minute step-upMFA with an authenticator app, and a fresh 5-minute step-up before privileged actions. Recovery codes are stored as keyed hashes.
Ed25519 · public keys onlyProbe and API requests are signed with Ed25519. We store only public keys, so no shared signing secret exists on our side.
keys: not in the databaseEncryption and service keys are never stored in the database.
hash-chained · keyed hashesAppend-only and hash-chained. Audit fields keep keyed hashes, never raw IP addresses.
12 h · 8 h idleA session ends after 12 hours, or after 8 hours without activity.
Disclosures
What we have not done yet, and what we choose not to do. Written down, so you can hold us to them.
Our Type I target scope is Security and Confidentiality. No auditor is engaged yet.
HIPAA Hawk maps technical safeguards. It does not certify.
The trust manifest says so too.
Shield is middleware and SQL you install and approve in your own app and database.
Fixed rules produce every finding.
We keep table names, policy names and flags.
GET /api/trust/manifest
"claims": {
"hipaaCertified": false,
"baaOffered": false,
"connectingCreatesBaa": false,
"soc2IndependentlyAudited": false,
"externalPentestCompleted": false,
"sitsInFrontOfSubscriberApi": false
}Every certification field in the manifest is false. A test checks that, and so does the server on every request.
Plans
Every plan includes the same checks; only the limits differ. Pricing on request during early access.
| Limit | Cloud | Dedicated |
|---|---|---|
| Systems | 25 | 500 |
| Data sources | 50 | 1,000 |
| A separate database per customer | Not included | Yes |
| Checks | All 13 Ravens | All 13 Ravens |
| Pricing | On request | On request |
Early access
Secure Raven is private and invite-only today. Tell us what you run.