Principles · Security
Trust requires specifics.
Security is not a mood, a lock icon, or a claim that a product is “safe.” It is a continuing practice of limiting access, reducing exposure, responding to problems, and stating clearly what has, and has not, been verified.
Keep access deliberate
Pamplemousse is currently a private beta. Accounts are reviewed and created through an operator-managed process rather than open self-service registration.
Authenticated areas require a session. Administrative actions are checked again on the server, and system-administrator access is separate from ordinary workspace roles. Disabled accounts stop resolving as valid sessions, and their existing sessions can be revoked.
Private beta status reduces casual exposure. It does not, by itself, make the application secure.
Invitation is an access policy, not a security certification.
Hold credentials to a standard, whoever holds them
Authentication is the part of Pamplemousse most likely to change during the beta, so this page describes the properties it is held to rather than the mechanism currently providing them.
Passwords are never stored in a form that can be read back. Sign-in failures return a generic error rather than confirming whether an address is registered. Whether that work is done by Pamplemousse itself or delegated to an established identity provider, the requirement is the same, and delegating it does not transfer responsibility for getting it right.
These are useful safeguards. They do not replace rate limiting, strong password guidance, multifactor authentication, monitoring, or ongoing review — and multifactor authentication is not currently implemented.
Protect credentials in layers.Hashing is a foundation, not the finished structure.
Treat sessions as credentials
A session is a reusable key to an account, and it is treated as one. Session tokens are carried in cookies the page’s own scripts cannot read, are marked secure in production, expire, and can be revoked — by signing out, by an account being disabled, or by an administrative action.
Route protection is layered rather than single-checked. The edge check is deliberately optimistic — it looks for a session cookie and nothing more — and the real resolution happens server-side, where the session is validated against the user’s current account state before any protected data is read. The intent is that a cookie alone never grants access to anything. Verifying that every protected route and action actually takes that path is part of the baseline below, not a completed audit.
A session should be revocable, expiring, and no more exposed than necessary.
Scope every request
Product records are associated with a workspace, and server-side helpers establish the current user and workspace before protected operations proceed.
That architecture is intended to keep requests within the authenticated workspace. It should not be presented as proven tenant isolation until every query, mutation, API route, file operation, cache key, and administrative action has been reviewed and tested for cross-workspace access.
Authorization belongs at the data boundary.Hiding a button is not permission enforcement.
Say what has not been established
Pamplemousse does not claim certification, regulatory compliance, independent audit, penetration testing, zero-knowledge architecture, end-to-end encryption, a particular data-residency regime, or a guaranteed incident-response standard. None of those has been established, so none of them is offered.
The private beta is the right time to complete a security baseline: rate limiting, dependency and secret scanning, backup and restore testing, vulnerability reporting, logging and alerting, access review, incident procedures, and an assessment of authentication controls such as multifactor support.
Honest limits are part of a credible security posture.
Never market beyond the evidence.
Known gap, stated plainly. There is no rate limiting on sign-in or on the public invite-request form. It is on the beta baseline above and has not shipped.
Have a security question?
Pamplemousse is in private beta, and its security documentation is still growing. Responsible questions and reports should have a direct path to the operator.