Security

Crop Picker is a public read-only catalog. This page describes the access model and the protections in place.

#Public vs. private data

The platform is designed so that the crop catalog — every piece of agronomic, economic, scoring, and buyer information visible on crops.every.farm — is intentionally public. Anything not meant to be public is simply not part of the catalog.

• Public, read-only: crop facts, regional snowflake scores, economics, buyers who have opted in to being listed, the full audit log of data changes.
• Not public: internal operational configuration, administrative credentials, and (when we add them) user-owned farm records.

#Access layers

Requests to the platform flow through two access tiers:

• Browser / anon role. Public clients read catalog data via a scoped read-only credential. Row-Level Security policies permit SELECT on catalog tables and nothing else. No write operations are available to unauthenticated clients.
• Server / service role. Data ingestion and maintenance happen server-side with a privileged role that is never exposed to browsers. That role's credentials are held in environment secrets on the hosting platform and never checked into source control.

#Row-Level Security

Every table in the public schema has Row-Level Security enabled. Policies are written with a principle of least privilege:

• Catalog tables allow SELECT to anon and authenticated users.
• The buyers table hides deactivated entries from public queries.
• User-owned tables (scaffolded for a future authenticated experience) grant no access at all to anon or unauthenticated requests — they return zero rows and reject every write.

Row-Level Security is verified at deploy time against the production database.

#Data provenance

Every data point in the catalog carries a citation. Every write to the database appends a record to an append-only audit log with the source, the source's publication date, and a diff of what changed. This means:

• Users can trace any number they see on the site back to its origin.
• Drift between scheduled ingestion runs is detectable.
• The audit log itself is public, so third parties can verify the chain of provenance end-to-end.

#Platform security

• Transport: all traffic is served over HTTPS.
• Secrets: credentials live in server-only environment variables and are rotated on any suspected exposure.
• Dependencies: automated vulnerability scans on the JavaScript dependency tree.
• Queries: all database queries use parameterized client libraries — no raw SQL from user input.
• Error handling: production errors are wrapped before leaving the server boundary so internal details don't reach clients.

#Reporting issues

If you discover a security issue, please email security@every.farm with a description and reproduction steps. We aim to acknowledge within one business day.