Security notes

Passwords are hashed with scrypt. Session tokens are random and only their hash is stored. Cookies are HTTP-only.

Project paths reject .., absolute paths, and paths outside src, public, and a small set of root files.

Generated code is not executed with Node privileges. The preview is a browser sandbox.

Local mode is still a single-machine development database. Do not expose this dev server to the public internet and treat it as production. Firebase security rules, Secret Manager, and an isolated build runner are future work, documented in docs/FIREBASE_SETUP.md and docs/ARCHITECTURE.md.