The current public surface
The public site has no product authentication or customer workspace. Its state-changing surface is the waitlist endpoint. That endpoint validates origin, payload size, email shape, bot fields, submission timing, and request rate before writing a record.
Database and secrets
Supabase is called only from the server route. The secret key is stored as a server-side environment variable and is never exposed through a NEXT_PUBLIC variable. Row Level Security remains enabled and anonymous browser clients are not given a direct insert or read policy.
Abuse and duplicates
The endpoint applies rate limiting and treats duplicate email submissions idempotently through a normalized unique email constraint. Errors return bounded messages rather than database internals.
Product boundary
These controls describe the landing site, not a completed hosted Meraki product. Authentication, tenant isolation, integration permissions, sensitive profile retrieval, incident response, and independent review require separate proof before hosted access expands.