# JARVIS Command Dashboard — Security Architecture

**Phase:** 3B hardening baseline

## Threat model summary

Primary risks:

1. Health data exposure through raw values, document text, document names, links or file paths.
2. Finance data exposure through exact values, transactions, account/broker details or reports.
3. Secret exposure through git, logs, stack traces, frontend bundles or OpenAPI/examples.
4. Runtime path leakage that reveals local structure or sensitive processing locations.
5. Accidental mutation through restart/generate/upload/confirm flows.
6. Context drift between docs, contracts, schemas and fixtures.

## Sensitive domain boundaries

- FinanceManager remains the source of truth for Finance.
- HealthManager remains the source of truth for Health.
- AutoShorts remains a separate domain system.
- JARVIS Gateway is a command layer and contract translator, not a super database.

## Tailscale-only MVP

The future dashboard is intended for local/Tailscale reachability only. Phase 3B does not configure Tailscale and does not hardcode Tailscale IPs or private hostnames.

## No public deployment

No public deployment is approved. No Tailscale Funnel. No internet exposure.

## Local-dev CORS policy

CORS exists only for future local Vue development.

Rules:

- Enabled only when `JARVIS_ENV=development`.
- Allowed origins are read from `JARVIS_DEV_CORS_ORIGINS`.
- Default origins: `http://127.0.0.1:5174`, `http://localhost:5174`.
- No wildcard `*`.
- `allow_credentials=false` in MVP.
- Production mode must not enable local-dev CORS.

## No secrets in Git

Never commit tokens, OAuth files, credential JSON files, `.env`, private keys or generated secret material.

## Redaction by default

The default policy is summary. Exact Finance values and Health detail links are disabled.

## Audit concept for later actions

Future write actions require Preview -> Confirm -> Audit. In Phase 3B no write actions exist.

## Logging rules

Logs must never include forbidden fields, raw payloads, stack traces with paths, secrets or exact domain values.

## Error sanitizing rules

Errors shown to API/UI consumers must be redacted and bounded. No stack traces, no local paths, no raw values.

## Demo mode

Phase 3B uses synthetic mock responses only. Domain access remains disabled.

## Forbidden fields

See `docs/security/forbidden-fields.md`.

## Git safety scan

`make verify` is mandatory before every commit and includes repository safety checks, schema/OpenAPI checks and gateway tests.