Security
Security Boundaries
What can be confirmed to users without exposing secrets or internal infrastructure.
English localization is preserved as a draft. It uses the same claim IDs and status model as the Russian source, but remains noindex until editorial review.
The browser and public pages must not receive API secrets, private storage keys or full exchange responses. Users see action status and data needed for the interface, not internal service credentials.
Storage, encryption and rotation details require separate Security review and are not published as promotional promises. This page records only confirmed boundaries.
Confirmed Boundaries
- Secrets must not enter public research files.
- API validation results are stripped of sensitive data.
- Operators work with request status, not an exposed secret.
- Private operations pass through a server boundary with user authorization.
Not Published
- Keys, tokens or decrypted access data.
- Exact internal paths and service configuration.
- Unverified claims of absolute security.
- Full storage design before Security review.