geointel/docs/SECURITY_AND_DATA_BOUNDARIES.md

Security and Data Boundaries

V1 is a local/single-user portfolio application. Still, it must avoid unsafe defaults.

Upload safety

• Enforce upload size limit.
• Store uploads outside source directories.
• Sanitize filenames.
• Do not execute uploaded files.
• Validate file type by content where possible, not only extension.

Path safety

• All storage paths must be resolved under STORAGE_ROOT.
• No user-controlled absolute paths.
• No ../ traversal.

Secrets

• No API keys in git.
• Use .env.example only.
• External service credentials stay in environment variables.

Network calls

• External data fetchers must have timeouts.
• Cache results where appropriate.
• Surface failures clearly.

AI model execution

• Do not download arbitrary model weights at runtime without explicit configuration.
• Model paths must be configured or stored under storage/models.
• If unavailable, return not_configured.