# Security notes
- Secrets: `.env` on the node only (mode 600), never in git, never sent to the browser; `Settings` are `SecretStr`; structlog redaction processor + regex on `userid|api_key|token|password|secret=`; httpx logging silenced. Tests assert the vendor id never appears in API responses, OpenAPI, audit, job results or raw-archive metadata.
- Auth: argon2id passwords, TOTP (pyotp) with obfuscated secret storage, 12 h sessions (hashed ids), CSRF double-submit on every non-GET browser request, SameSite=Strict + Secure + HttpOnly cookies, login rate limit (10/min/IP).
- API keys: `fd_<prefix>.<secret>`, HMAC-SHA256 hashed, scopes `read:market read:fundamentals query export admin`, optional expiry, revocation, per-key rate limit, daily usage rows.
- Transport: TLS at the MacLustr Tunnel (Caddy, BHS64); API bound to 127.0.0.1; HSTS; CSP `default-src 'self'`; `X-Frame-Options: DENY`; request ids on every response.
- Query sandbox: DuckDB in-memory, `allowed_directories` = lake curated/_retired, `enable_external_access=false`, single SELECT/WITH statement, keyword deny-list, timeout, row cap.
- Exports: owner/principal scoped, 72 h expiry, served from `lake/exports` only.
- Dependency scanning: `make audit` (pip-audit) in CI (`.github`-less: run on the node before deploy; results in STATUS.md).
- Encryption at rest: Apple internal SSD; FileVault is **disabled** on M3U96a by cluster policy (auto-login after power loss, decision 2026-09-10). Backups go over SSH to a LAN node with the same policy. If encryption at rest becomes a requirement, enable FileVault on M3U96a and M4M64a (trade-off: unattended reboot requires a manual unlock).
- License: FirstRate Data private use — the platform exposes no public data route; redistribution of bars/tables to third parties is prohibited and surfaced in the console and the API catalog.