Application Security Requirements

Apply these rules when reviewing the security implications of any code change in this project. The framing is OWASP Top 10 mapped onto this project's specific stack — Next.js App Router, Payload CMS (SQLite/Turso, Vercel Blob), Remark/Shiki markdown, Vercel hosting, Sentry, Mixpanel.

Secret and Environment-Variable Handling

See secret-handling.md for:

• No literal secret committed (Payload secret, Sentry DSN with auth token, Vercel Blob token, Turso auth token, test user password)
• process.env.* accessed only inside the project's whitelisted env-access files
• NEXT_PUBLIC_* prefix used only for values intentionally exposed to the browser
• .env.local is gitignored; example only in .env.example

Input Validation

See input-validation.md for: