Protected reviewer access

Open the OptiCat review queue

Approved reviewers receive a one-time sign-in link. Access still requires the immutable admin role in Supabase.