Administrative routes require the configured bearer token. Comparison hashes both supplied and configured values before constant-time comparison. Production rejects the documented change-me placeholder. V0.1 has no user identity, RBAC, organization boundary, rotation endpoint, or session management; deploy the dashboard and API behind trusted network controls.

SDK keys contain a public lookup prefix and 256-bit random credential. PulseFlag reveals the full value once, stores only the prefix and SHA-256 digest, verifies digests in constant time, and supports revocation. SHA-256 is appropriate here because generated secrets have high entropy; it is not a password hashing recommendation.

The API accepts only configured origins and never defaults to wildcard production access. Allowed methods and headers are explicit. Body size is capped. Container and reverse-proxy deployments should add TLS, HSTS, and network policy at the edge.

Zod bounds identifiers, names, arrays, context attributes, rules, conditions, rollout allocations, queries, and evaluation payloads. Database constraints provide a second integrity layer. Responses use stable error codes and request IDs without stack traces or raw database errors.

Evaluation routes use Fastify rate limiting with a configured requests-per-minute ceiling. The current limiter is process-local unless configured with a Redis-compatible store in a later version, so distributed deployments must enforce an additional shared edge limit.

Pino redacts authorization, SDK key headers, secrets, and administrator-token fields. Evaluation context and arbitrary user attributes are not explicitly logged. Audit metadata is constructed from identifiers and counts and never includes credential material.

.env and .env.* are ignored except .env.example. Examples contain placeholders only. Production secrets should come from a platform secret manager. PostgreSQL and Redis URLs may contain credentials and must not be logged or committed.

V0.1 does not include OAuth, SSO, actor attribution, RBAC, encrypted application-level fields, TLS termination, distributed rate limiting, SDK key rotation overlap, or security event export. These limits must be considered before any production deployment.