# Security notes

- Document root must be `public/` only.
- `.env`, `cases/`, `prompts/`, `fixtures/`, `storage/`, `vendor/` diagnostics and `.git` must not be web-reachable.
- CSRF + same-origin checks on mutating API actions.
- Attempt IDs are opaque; guessing must not leak content.
- Uploads: extension + MIME checks, ZIP bomb/traversal limits, size/unit/character caps before provider spend.
- Model output is untrusted: schema + semantic validation; PHP owns stage/criteria/acceptance.
- Error logs must not include prompts, transcripts, filenames with PHI, or secrets.
- No third-party analytics, remote fonts or trackers.
- Host-level access control is required before exposing a funded API key on a public URL. Set `HOST_ACCESS_PROTECTED=true` only after verifying that control covers API routes.