Server-Side Storage Boundary
All sensitive configurations, tokens, database passwords, and API keys (e.g. Stripe, Gemini) must remain encapsulated in server environments, accessed strictly through `.env` variable lookups.
Zero Client-Side Keys
Frontend templates and client-side binary distributions are prohibited from direct external credentialed calls. All requests must route through local security proxy handlers.
RLS & Firebase Guards
PostgreSQL Row Level Security (RLS) and custom authentication matching on Firebase rules prevent unauthorized multi-tenant or generic wildcard access to database schemas.
DevOps Pre-Push Scan
The `devops-git-guard` module automatically inspects repository changes, audits stage directories for accidentally saved keys, and validates `.gitignore` paths before sync commits.