Security
Security Overview
Grounded treats authentication, tenant isolation, source integrity, and auditability as product requirements, not later decorations.
Authentication
Web authentication uses server-managed httpOnly cookies. Access and refresh tokens are not exposed to browser JavaScript in the web application flow.
Session Rotation
The backend issues short-lived access tokens and rotating refresh tokens. Refresh token reuse is treated as a compromised session family.
Tenant Boundaries
Document ingestion, listing, retrieval, and question answering are scoped to the tenant claim attached to the authenticated session.
Audit Events
Security-sensitive operations such as login, refresh, logout, password change, and session revocation are designed to write audit events.
Responsible Disclosure
Security issues should be reported privately with reproduction steps, affected routes, expected impact, and any relevant logs or screenshots.