# Shared comments reference

The public template uses IndexedDB and clearly labels comments as device-local. For shared moderated comments, deploy the supplied Supabase schema and Edge Function.

Security requirements:

- keep the service-role key only in the Edge Function;
- validate Turnstile server-side;
- add platform rate limiting before public launch;
- publish only `approved` records;
- never expose private email addresses in the public comments query;
- render returned comment text with `textContent`, not unsanitised HTML;
- provide privacy, moderation and deletion procedures.
