Security basics

Principles

The public API returns explicit DTOs and bounds relation depth and query cost. Service accounts have separate scopes, expiry and an audit trail.

Content

Players create proposals only. Publication goes through reviewer workflow, and media URLs are checked against an allowlist and content hash.