This directory records the enforceable security direction for flowOS. It complements the API, offline, Redis, database, and architecture documentation; it does not replace implementation-specific tests.
- Principles and threat model
- Authentication, authorization, and tenant isolation
- Client security: web, mobile, desktop, and offline
- Platform security: API, database, Redis, secrets, dependencies, rate limits, validation, and uploads
- Operations: incident readiness and the current audit
Tenant data leakage is a critical-severity defect. Security-sensitive changes require a reviewer to check tenant scope, active membership, authorization, input allowlists, secrets, logs, and relevant negative-path tests.