Trust and security
MVP security notes.
These notes describe the current local implementation. They are not a security certification, penetration-test result, service-level agreement, or production-readiness statement.
Workspace boundary
Organizations are the tenant boundary. Server-side actions derive the active organization from the authenticated session and membership. Browser-supplied identifiers alone do not authorize access.
Roles and approvals
The MVP uses Owner, Admin, Editor, and Viewer roles. Approval permissions are limited to Owners and Admins.
Sessions and passwords
Password hashes are created with bcrypt. The application uses opaque server-side sessions and an HTTP-only, SameSite=Lax session cookie with a current maximum lifetime of 14 days.
Local data storage
The MVP uses SQLite for reproducible local development. SQLite is not the intended database for a concurrent public service.
Current limitations
Before public launch, the product requires a production database migration, durable distributed rate limiting, production email and account-recovery flows, configured infrastructure, independent QA and security review, and release approval.
Next step