Firewall and WAF controls
Control layers
| Layer | Control | Current evidence |
|---|---|---|
| Cloudflare edge | Autonomous DDoS protection is a provider baseline for Cloudflare services | Provider capability confirmed; account tuning not reviewed |
| HTTP application edge | Cloudflare WAF, custom rules, managed rules, rate limits, and security events are available by plan and configuration | Capability confirmed; enabled rules and plan entitlements not verified |
| Static hosting | Only the built application artifact is served; no application-owned origin server is exposed | Architecture confirmed |
| Supabase gateway | Managed routing separates authentication, data, storage, realtime, and serverless services | Architecture confirmed |
| Database | Grants, row-level policies, constraints, and restricted trusted operations control data access | Current catalog confirms row-level security on reviewed public tables; policy correctness remains reviewable |
| Application | Authentication, authorization, input validation, tenant checks, and provider-callback validation provide application-layer filtering | Implemented in relevant flows; not a substitute for edge WAF controls |
Required operating standard
- Keep automated DDoS protection active.
- Review and enable the appropriate managed WAF ruleset for the production zone.
- Apply rate limits to authentication, callbacks, and abuse-prone operations.
- Test rule changes in a controlled environment and monitor false positives.
- Restrict administrative access and retain rule-change evidence.
- Review security events and link confirmed attacks to incident response.
Rule evaluation model
| Order | Decision layer | Evaluation data | Result |
|---|---|---|---|
| 1 | Provider network protection | Connection and volumetric traffic characteristics | Absorb or reject platform-level denial-of-service traffic |
| 2 | Cloudflare managed and custom rules | Request host, method, path, headers, source characteristics, and managed signatures | Allow, challenge, log, or block according to the active edge policy |
| 3 | Rate and bot controls | Request frequency, endpoint sensitivity, client behavior, and account-flow risk | Throttle or challenge abusive automation while preserving legitimate use |
| 4 | Managed gateway | Service route, token format, request shape, and provider limits | Route valid requests to the intended service and reject malformed or unauthenticated access |
| 5 | Application authorization | Current actor, tenant, role, hierarchy, ownership, object, and workflow state | Permit the exact business operation or deny it |
| 6 | Database and storage policy | Caller role, row predicate, object ownership, and execution grant | Restrict accessible records and objects even if browser or edge controls are bypassed |
The edge control review records active rules and executes benign validation cases for allowed traffic, prohibited methods, oversized requests, repeated login attempts, high-rate API access, known malicious patterns, path traversal probes, untrusted origins, missing security headers, and false-positive business traffic. High-impact rule testing is restricted to an authorised non- production scope so legitimate production operations remain unaffected.
Rule change procedure
- Record the threat, route, method, expected traffic, proposed expression, action, owner, and expiry.
- Test the rule in log-only mode or an equivalent non-blocking environment against malicious and legitimate examples.
- Review false-positive impact on authentication, document upload, provider callbacks, static assets, and managed-service requests.
- Obtain approval for challenge or block behavior and define the immediate disable path.
- Deploy with a bounded observation window and monitor security events, error rate, and business conversion signals.
- Promote, narrow, or remove the rule from observed evidence; retain the decision and examples.
Exception handling
An allow rule records the exact route, source or identity basis, business owner, reason, compensating authorization, logging, expiry, and review date. Broad IP, country, path, or user-agent exceptions are not accepted as substitutes for application authorization. Provider callback exceptions remain restricted to the documented callback route and still require provider authenticity and replay validation.
Evidence limitation
No claim is made that optional Cloudflare WAF rules, custom rules, rate limits, bot controls, alerts, or network restrictions are currently enabled. A dated account export or screenshot is required before representing those settings as implemented.