Least privilege, project isolation, and no browser-side secrets
Security controls are enforced in the backend; the frontend is not a security boundary.
01
Identity and isolation
Every operational read or write is attached to an authenticated project.
- Owner, Widget, Agent, and SRS Editor use separate tokens
- A central policy rejects endpoints outside a token's capability
- Shared records link to projects through project_records
- The opt-in demo is isolated from real project state
- Raw tokens are not stored; only HMAC/SHA-256 plus last4
02
Data protection
Test credentials and evidence require stronger handling.
- AES-256-GCM for test credentials
- Only an Agent token may lease a credential
- Private S3 keys and short-lived read URLs
- MySQL, S3, and AI secrets exist only in backend env
- Independent token, file-signing, and credential keys
- Never place secrets in NEXT_PUBLIC_*
03
Network protection
Outbound connectivity is a critical trust boundary.
- Exact-host WEBHOOK_ALLOWED_HOSTS
- Private, loopback, and link-local destinations blocked
- Bounded timeout and no automatic redirects
- CORS limited to FRONTEND_URL
- Rate-limited project creation
- TLS and security headers at Coolify/reverse proxy
04
Security gates before production
These are acceptance items, not marketing claims.
- Field/action segregation-of-duties review for high-risk stories
- Database-level tenant isolation tests
- Token rotation, expiry, and revocation policy
- Dependency and container scanning
- Retention, deletion, backup policy
- Auth and outbound-failure alerting