# ActBootFree security contract

ActBootFree follows ActCitizen's security boundaries without sharing secrets,
encryption keys, sessions, or citizen data between applications.

## Authentication

- Use WebAuthn/passkeys as the primary sign-in method.
- Keep signed sessions in secure, HttpOnly, SameSite cookies.
- Require origin and RP-ID validation for every WebAuthn ceremony.
- Require authentication for progress, notes, messaging, and email actions.
- Keep anonymous browsing and public constitutional content available.

## Data and storage

- Encrypt stored progress and notes with an ActBootFree-specific key.
- Store keys only in Azure application settings or Key Vault.
- Validate and size-limit every request before storage.
- Record an audit event for sign-in, data export, deletion, messaging, and email.
- Provide account export and deletion before enabling persistent citizen accounts.

## Messaging and email

- Send email only from server-side Azure Functions.
- Keep provider keys out of browser bundles and all `VITE_` variables.
- Rate-limit contact, notification, and messaging endpoints.
- Avoid placing sensitive civic or account data in email subject lines.
- Treat inbound email and message content as untrusted input.

## Development modes

`ACTBOOTFREE_MOCK_DATA=true` enables local-only mock users and fixture data. The
mock mode must be disabled in Azure production settings. The current browser
preview switch is presentation-only and is never an authentication boundary.

## Azure deployment

The frontend is deployed through Azure Static Web Apps. Backend Functions,
storage, and email providers should be added as separate server-side resources
in `rg-bootfree` when the corresponding feature is implemented. No production
credential belongs in this repository.