Security
Defense-in-depth for creative infrastructure, not just checkboxes.
Security is implemented as system behavior across routing, credentials, and deployment workflows.
Transport and Browser Security
HTTPS, HSTS, and strict security headers are enabled by default for all routes.
Access Segmentation
App surfaces are separated by route group with explicit auth and settings boundaries.
Provider Credential Handling
Runtime diagnostics show which provider keys are configured without exposing secrets in UI.
Operational Observability
Generation and export states are recorded with explicit status transitions for debugging.
Developer Security Checklist
- Set required provider env vars in `.env.local`.
- Verify provider diagnostics in `/settings/keys`.
- Run `pnpm --filter @videoviber/web lint` before PRs.
- Run `pnpm --filter @videoviber/web typecheck` before PRs.
- Run `pnpm --filter @videoviber/web build` to validate deploy parity.