Draft for review · September 5, 2026 · Not yet in effect
The current website
The waitlist implementation keeps the database secret on the server. The browser submits to a same-origin endpoint; it cannot list or directly retrieve waitlist records. The prepared database migration enables row-level security and removes anonymous and authenticated browser-role access. These are implementation measures awaiting live deployment verification.
Submission protection
The application validates fields and consent, limits request size and submission rate, ignores repeated normalized email addresses, uses a honeypot to reduce automated abuse, and avoids putting signup contents into application error logs. The site has a restrictive content-security policy and serves fonts and images locally.
Member access foundation
The member implementation verifies the signed-in identity with Supabase and checks active membership before returning private account data. Session cookies are HttpOnly, host-only and Secure in production. Prepared database policies restrict goals to their owner and prevent members from granting themselves access or changing account status. Same-origin write checks and authentication rate limits are implemented. These measures have passed local tests with simulated provider responses; the migration and end-to-end authentication still need verification in the live database.
Future customer workspaces
Customer data isolation, role-based access, campaign approval controls, suppression handling, activity history, and source provenance are requirements for the future product. They are not represented here as completed or independently audited controls.
Certifications
ListingGTM does not claim SOC 2 certification, ISO 27001 certification, a completed penetration test, or a guaranteed service level. Any future assurance claims will identify their actual scope and status.
Report a concern
Contact Dealpro through dealpro.io and identify ListingGTM. Share a description and the affected URL, but do not send passwords, API keys, or private contact lists. A direct security contact must be established before production launch.