Security posture for this MVP:
- No credentials are required for the local demo.
- No real personal, genomic, medical, voting, financial, industrial, or aerospace operational data is accepted.
- The API rejects common real-world regulated-data markers.
- Audit records are append-only within the runtime process.
- CI runs lint, build, and tests.
Before real deployment, add threat modeling, authentication, authorization, rate limiting, privacy impact assessment, secret scanning, dependency scanning, secure logging, backup design, and incident response.