Security

Security

Small data footprint, explicit boundaries.

The production server serves only built public assets. It has a content security policy, restricted request methods, path checks, security headers and request throttling. React displays notes as text; it does not execute user-entered HTML. Imported data is not accepted in this release.

Not applicable to this version

There are no passwords to hash, API keys to conceal, authentication sessions, admin routes or database permissions. Public static assets are intentionally readable. These features require proper server-side controls before any account or cloud implementation.

Review status

Dependency vulnerability checks, source checks and focused security tests are part of this revision. They are not a penetration test or a guarantee that the app cannot be compromised. Public hosting must supply HTTPS and enforce the documented headers; localhost settings are not proof of a deployed configuration.

Report an issue

Report security or support issues to Ryan Mortus. Do not send patient data, credentials or exploit payloads containing someone else’s information.