Supr

Trust

Security at Supr

Last updated: July 2, 2026

Supr is built around a simple boundary for founders who need help without opening the engine room: customers use the SaaS dashboard and approved API routes, while agent execution stays behind private Cloudflare service bindings and organization authorization. That gives builders a full agent experience without exposing runtime credentials or direct execution URLs.

Security model in plain English

The public site explains Supr, the app handles the customer workflow, the Worker API enforces account state and plan limits, and permanent SuprOS workers execute only after the required approvals and budget reservation.

  • Protected customer routes and separate admin-only routes.
  • Stripe webhook signature verification before billing state changes.
  • Usage and billing checks before an agent run is allowed.
  • Short-lived signed launch context for full-screen agent access.

Platform boundaries

Supr uses Cloudflare Pages for the public site, customer app, admin app, and documentation. Cloudflare Workers provide the API boundary for authentication, billing, usage enforcement, webhook handling, audit records, assignment Workflows, and usage projection. Private SuprOS Worker and storage bindings are not accessible directly by customers.

Account and route protection

Customer dashboard routes require authentication. Admin dashboard routes require an admin role. Sessions are managed through the API layer, and sensitive account actions are tied to organization and user context rather than trusting browser-provided identifiers.

Agent run protection

Before Supr starts agent work, the API checks the signed-in user, organization, project, subscription status, plan limits, usage state, autonomy level, and approval policy. Approved requests include only the context needed by the runtime: user ID, organization ID, project ID, plan limits, autonomy settings, approval policy, project context, and prompt.

Billing and webhook security

Stripe handles payment details. Supr stores Stripe customer and subscription identifiers, subscription status, cancellation state, and billing events needed to enforce access. Stripe webhook events are verified before they update subscription state or unlock paid features.

Usage, audit, and abuse controls

Every agent run creates a usage record. Supr uses those records to enforce plan limits, explain billing, investigate support cases, and detect suspicious usage. Rate limits, audit logs, admin views, and policy enforcement give the platform a record of important account, billing, and runtime actions.

Secrets and infrastructure

Runtime credentials, Stripe secrets, service tokens, and signing keys belong in environment variables or platform secret stores. They should not be committed to the repository, placed in frontend bundles, or copied into support tickets.

Responsible disclosure

If you believe you found a vulnerability, email [email protected]with the affected URL, steps to reproduce, impact, and any safe proof of concept. Do not access, modify, delete, or exfiltrate data that is not yours.