Security Overview

• Authentication via Microsoft Entra ID (OAuth 2.0 / OIDC)
• REST-only boundary; no server secrets in the browser
• Strict headers and Content Security Policy
• Audit logging and least-privilege permissions