Security

Security in SideLink is mostly about keeping trust boundaries visible and local state under user control.

Principles

• Local-first storage and execution
• Explicit user-triggered mutation actions
• Defense in depth: validation, rate limits, redaction

Request Hardening

• Typed validators for mutation endpoints
• Auth middleware and session checks
• Rate-limited sensitive routes with retry hints

Data Protection

• Password hashing with strong KDF
• Secret encryption at rest
• Controlled token issuance for helper workflows

Logging

• Structured logs with category codes
• Redaction for credentials, keys, and tokens

Operational Safety

• Real execution gates to avoid accidental destructive actions
• Install pipeline state machine with explicit failure reasons
• Recovery and retry telemetry for refresh/install jobs

Release Safety

• packaged desktop artifacts are smoke-tested before publication
• first-run admin creation is explicit rather than seeded from default credentials
• docs deployment uses GitHub Actions instead of a generated branch artifact path