Most early-stage SaaS hide their pace. Showing it openly says: we're alive, we ship, and you can audit it.
CURRENT:Phase C · Day 4 — auth flow live · 13/13 E2E checks green
2026-05-06
Phase C · Day 4
Email + password signup, login, verify-email flow
Argon2id with OWASP 2025 params; timing-safe verify against unknown emails via dummy hash; Mailhog wired for dev SMTP. 13/13 E2E checks green.
7a889e2
2026-05-06
Phase C · Day 3
Auth middleware + request-scoped Postgres GUC
JWT-cookie based identity resolution; per-request app.agency_id GUC pinned via tx_for() helper; 4 middleware unit tests.
7a889e2
2026-05-06
Phase C · Day 2
RLS migrations + non-superuser app role
6 migrations applied. 26 row-level security policies. RLS isolation verified across 4 perspectives. Postgres now refuses cross-tenant reads at the data plane.