NoeVault Snip Security Validation Guide

Scope: Validated security boundaries for NoeVault Snip v1
Does not replace: Organisational security policy or penetration-test reports

Trust boundaries

Browser (@noevault/snap)
  ✗ AppKey / client secrets
  ✓ Browser-safe bootstrap only
  ✓ Host app cookies/session for BFF

Host BFF
  ✓ AppKey / server credentials
  ✓ Maps app user → ExternalSubject / ExternalRequester
  ✓ Fail-closed for anonymous

NoeVault API
  ✓ Ticket access evaluation
  ✓ RequireApiAuth correction (authoritative)
  ✓ Evidence pipeline constraints

Identity security (Model B)

Control	Status
No UserUID minting for external requesters	Required
No seat consumption on Snap create	Required
No OLEA creation on Snap create	Required
Stable subject continuity (`KP-USER-*`)	Required
Tenant isolation (org/solution scope)	Required

Bootstrap

Case	Expected
Anonymous	Unauthorized / `SNAP_APP_SESSION_REQUIRED` (or host equivalent)
Authenticated entitled	Bootstrap projection without secrets
Disabled capability	Launcher hidden / deny — fail closed

Evidence security

MIME / size / field constraints enforced server-side.
Client preflight is advisory only.
Redaction is best-effort UX; do not treat client redaction as cryptographic guarantee.
Operators should still handle evidence as potentially sensitive.

Actor display

Display names are presentation projections. They must not invent persisted personal identity. System label reserved for genuine system events (PR-8.7E.4A).

Conversation

Polling-only updates avoid a second realtime channel in v1. Authorization remains ticket-access based on each GET/POST.

Validation references

Hosted authenticated validation: Evidence pack:

NoeVault Snip Security Validation