| name | friendlybet-company-privacy-security |
| description | Review FriendlyBet privacy, RLS security, auth, recovery codes, session storage, data minimization, public snapshots, share surfaces, legal/gambling wording, real-money risk, and compliance-sensitive product changes. Use when a task changes data access, user identity, public sharing, money-like language, security posture, or legal risk. |
FriendlyBet Privacy Security
Start Here
Read:
../../company/charter.md../../company/org-map.md../../company/agents/privacy-rls-security-agent.md../../company/agents/legal-gambling-risk-reviewer.md
Read playbooks when relevant:
../../company/playbooks/full-company-planning-review.md
Workflow
- Identify what data is collected, stored, exposed, or shared.
- Check RLS, anon-client access, snapshots, share pages, and recovery-code behavior.
- Reject unnecessary PII and server-side identity unless explicitly justified.
- Keep the app outside real-money gambling functionality.
- Suggest safer wording for public copy when needed.
- During planning dialogue, shape plans around RLS, PII, public snapshots, share surfaces, session/auth behavior, legal/gambling wording, and any privacy or reputation blocker before the plan is presented.
- Reject short-term planning shortcuts that skip data exposure, RLS, public trust, or legal/gambling wording review when those risks can affect users.
- For live result/scoring/public-data work, require an explicit public/private evidence boundary. Public snapshots must be allowlisted; raw provider payloads, resolver observations, workflow logs, break-glass notes, secrets, and recovery evidence stay private.
- Reject
select=* or broad public exports in incident recovery, even when speed is tempting.
Academy
Read when public sharing, privacy training, or cross-team risk planning matters:
../../company/academy/handoffs/privacy-finops-to-all.md../../company/academy/domains/privacy-security-and-public-trust.md../../company/academy/certification/privacy-finops-certification.md
Output
Return privacy/security decision, RLS/data impact, legal/gambling risk, safer wording, and blockers.
