Security boundaries

JumpCLI's security design depends on clear permission, network, and secret boundaries. All documentation, operations, and development work must preserve these boundaries.

Information that must not be disclosed

• Operator step-up verification keys, access-gate keys, and cookie contents.
• Casdoor management tokens, OIDC client secrets, and Meteroid credentials.
• Alipay private keys, signing material, SMTP passwords, and upstream API keys.
• Customer images, prompts, payment information, audit records, and internal IP addresses.

Accounts and permissions

• Regular accounts cannot read operator configuration or another customer organization's data.
• Operator actions require both a signed-in account and short-lived operator step-up verification.
• Suspension, restoration, plan publication, and payment-exception handling must retain audit records.
• Identity recovery uses the authentication service's supported flow; operators do not collect passwords.

Deployment and network

• The public application, documentation, authentication, and API use HTTPS.
• Billing, database, object-storage, and queue services remain on the internal network.
• Trust only explicitly listed reverse proxies and upstream hosts.
• When changing secrets, complete the rotation plan and validation before revoking old values.
• Before rolling the single app container forward, back up data/, images/, and maintenance/, then verify /ready and a browser smoke test; if either fails, restore the previous verified image and env values before shifting traffic.

When a suspected leak is found, immediately revoke or rotate affected secrets, inspect access logs, and assess the impact on issued sessions and payment operations.