Authentication boundary
Authentication proves identity only.
An authenticated account is not payment proof and does not unlock Premium or download access by itself.
Security
Security boundaries for TokVault Web access preparation.
Payment authority
Payment and entitlement decisions are server-authoritative.
Web Premium requires server-side billing confirmation and cannot be unlocked by browser state, redirect, invoice identifier, QR visibility or interface text.
Secret handling
TokVault does not intentionally expose API keys, webhook secrets, signing material or private provider link material in public pages or browser code.
Transactional email sending is handled through a protected server-side mailer.
Download boundary
Download access remains locked until a separately reviewed download bridge and quota system is implemented.
Responsible reporting
Report suspected security issues to support@tokvault.app.
Do not send passwords, wallet seed phrases, private keys, private auth links, reset links, payment secrets or browser cookies in ordinary email.