• Cognito protects all task and AI API methods.
• Lambda derives ownership from the authenticated Cognito sub claim.
• Client-provided userId fields are intentionally ignored for authorization.
• DynamoDB keys are scoped to USER#<sub>.
• Task updates/deletes use conditional existence checks.

Never commit:

• AWS access keys or secret keys
• bearer tokens
• refresh tokens
• private keys
• provider API keys
• passwords

Frontend configuration contains public Cognito identifiers and an API endpoint, but it must never contain a secret credential.

The legacy repository contained a hard-coded Cognito bearer token in an old frontend API module. The upgraded source removes it and CI blocks common credential/token patterns. Because Git history can retain old content, repository owners should treat any previously exposed session token as compromised and revoke/sign out the associated session where possible. If any long-lived credential was ever stored there, rotate it immediately and consider a history rewrite using an appropriate secret-removal process.

The frontend S3 bucket is private. CloudFront uses Origin Access Control and HTTPS redirect. Lambda receives only the DynamoDB and Bedrock permissions it needs.

If you discover a security issue, do not open a public issue containing credentials or exploit details. Contact the repository owner privately and provide enough information to reproduce the problem safely.