# Security and Data Boundaries

V1 is a local/single-user portfolio application. Still, it must avoid unsafe defaults.

## Upload safety

- Enforce upload size limit.
- Store uploads outside source directories.
- Sanitize filenames.
- Do not execute uploaded files.
- Validate file type by content where possible, not only extension.

## Path safety

- All storage paths must be resolved under `STORAGE_ROOT`.
- No user-controlled absolute paths.
- No `../` traversal.

## Secrets

- No API keys in git.
- Use `.env.example` only.
- External service credentials stay in environment variables.

## Network calls

- External data fetchers must have timeouts.
- Cache results where appropriate.
- Surface failures clearly.

## AI model execution

- Do not download arbitrary model weights at runtime without explicit configuration.
- Model paths must be configured or stored under `storage/models`.
- If unavailable, return `not_configured`.