SECURITY
Every public client is untrusted.
Miyaniva’s security model relies on server authorization, bounded public projections and strict separation between consumer and staff packages.
Public security contact availablePUBLICPublished, cacheable projectionsACCOUNTAuthenticated private stateSTAFFServer-authorized operations
Least privilege
A public identifier or visible route does not grant write access or access to related private collections.
Staff boundary
Admin actions require a staff build gate plus authoritative identity and role checks.
Responsible disclosure
Report a suspected vulnerability to destek@miyaniva.com with ‘Security’ in the subject. Do not include passwords, tokens or unrelated personal data.