Data and storage boundaries
- Uploaded files and output artifacts are intended to stay in private storage.
- Owner-only downloads should be served through authenticated checks, not public buckets or permanent public output URLs.
- Signed URLs must not be returned to the frontend for V1 output access.
- RLS and owner-scoped checks protect user metadata and workflow history.
Secrets and payment safety
- Service-role secrets must stay server-only and must never be exposed in browser code.
- Creem webhook verification must use the raw request body and the creem-signature header.
- The checkout success page must not grant points or trust query parameters.
- Verified server-side webhook processing is the only trusted source for paid point grants.
Runner and logging boundaries
- The Safe Step Library does not execute arbitrary code.
- V1 does not execute custom JavaScript, custom Python, shell commands, browser automation, scraping, OAuth flows, external API connectors, or AI provider calls.
- Logs should avoid raw CSV content, complete cell values, secrets, tokens, payment secrets, and raw provider payloads.
- Creators cannot see V1 user inputs or outputs.
Roadmap boundaries
- Cloudflare, ASN, BGP, BYOIP, Magic Transit, and network reputation work are optional future roadmap items and are not required for V1 closing.
- Flowwyn does not currently claim SOC 2, ISO, HIPAA, GDPR, or CCPA certification.
- Security reports can be sent through support until a dedicated security contact is configured.
V1 security posture
Security controls are strongest when storage, RLS, usage logging, point ledger updates, and payment webhooks all remain server-trusted.
Do not move service-role operations, point grants, or payment decisions into client-side code.