Security

This part is for whoever has to decide whether the stack may run in their company, and for anyone who finds a flaw. It says what the stack protects, from whom, which control holds each boundary and which test proves it.

Read it in this order:

1. The evaluator’s checklist: thirteen controls, each with the test that proves it and a command to check it yourself.
2. Sign-in: your company chooses how people sign in.
3. The threat model: assets, attackers, trust boundaries and residual risks.
4. Secrets and tokens: where each is kept, who can read it, backups, rotation and expiry.
5. What leaves the stack: every outbound host and what each call carries.
6. Reporting a vulnerability: privately, through GitHub security advisories.