# Security

## Secrets

Never hardcode Telegram tokens, provider keys, database passwords, S3 keys, or internal tokens. Use `.env` and keep `.env.example` placeholder-only.

## Input Validation

Validate all Telegram callback data, prompt length, uploaded media type, media size, aspect ratio, resolution, duration, FPS, and quality. Server-side validation is mandatory because client data is not trusted.

## Authorization

- User project access must be owner-only.
- Admin dashboard must require authenticated admin role before production exposure.
- Internal API calls must use `INTERNAL_API_TOKEN`.
- Provider webhooks must verify signatures and idempotency keys.

## Error Handling

User-facing errors should be safe and helpful. Internal errors should be logged with request ID, user ID, project ID, job ID, provider ID, event, status, and error code.