03 / SECURITY

Private by design.
Public only by intent.

The public website is separated from private administration, connected-account data and sensitive credentials.

Only intended routes cross the boundary.

Dedicated public originExplicit OAuth callbacksServer-side credentialsHuman authorization