Initial public release

docs/SECURITY_AND_DATA_BOUNDARIES.md

@@ -0,0 +1,35 @@
+# Security and Data Boundaries
+
+V1 is a local/single-user portfolio application. Still, it must avoid unsafe defaults.
+
+## Upload safety
+
+- Enforce upload size limit.
+- Store uploads outside source directories.
+- Sanitize filenames.
+- Do not execute uploaded files.
+- Validate file type by content where possible, not only extension.
+
+## Path safety
+
+- All storage paths must be resolved under `STORAGE_ROOT`.
+- No user-controlled absolute paths.
+- No `../` traversal.
+
+## Secrets
+
+- No API keys in git.
+- Use `.env.example` only.
+- External service credentials stay in environment variables.
+
+## Network calls
+
+- External data fetchers must have timeouts.
+- Cache results where appropriate.
+- Surface failures clearly.
+
+## AI model execution
+
+- Do not download arbitrary model weights at runtime without explicit configuration.
+- Model paths must be configured or stored under `storage/models`.
+- If unavailable, return `not_configured`.