Fenced is a simulator. It must not be connected to physical controls without an airport-owned safety case, approved PLC/SCADA interlocks, incident-command authorization, manual override, independent readback, and site-specific validation.

• Keep MIREYE_API_KEY server-side and load it only from the runtime environment.
• Never place a credential in a VITE_ variable, URL, fixture, source file, image, build argument, or container layer.
• .env and .env.* are ignored; only the empty .env.example template is tracked.
• Rotate a credential immediately if it has appeared in chat, logs, screenshots, shell history, or a commit.

The web client receives only a boolean indicating whether live Mireye mode is available; the health endpoint does not reveal it. The API adapter never serializes the credential, and upstream failures expose only a redacted status-level message.

The container context excludes .env*, keys, Git metadata, tests, reports, and dependency trees. The runtime image contains compiled server JavaScript rather than TypeScript source or development tooling.

• Every physical action in this repository is simulated.
• Only configured controls that pass capacity, authority, and life-safety checks may be selected.
• A command acknowledgement is not proof of actuation; independent position readback is required.
• Missing or unknown readback, active life safety, insufficient buffered capacity, or rainfall outside the configured playbook forces ESCALATED.
• BOUNDARY_VERIFIED means only that one configured hydraulic boundary received an explicit simulated closed readback. Recovery, sampling, downstream status, and reportability remain separate objectives.
• Mireye context is screening evidence, not a storm-drain graph, plume model, exposure result, or containment prescription.
• Missing formulation or concentration keeps reportability UNRESOLVED for human review.

• API payloads are size-limited and strictly validated; unknown modes, faults, and routes return structured errors.
• Cross-site run requests are rejected. Per-IP rate limits, a concurrency ceiling, idempotency keys, five-minute live-context caching, and single-flight acquisition bound upstream usage.
• Live Mireye responses are checked for coordinate agreement, freshness, declared field TTL, tri-state status, value ranges, expected field names, response size, and safe provenance schemes.
• The metered campaign requires an explicit credit ceiling, checks current pricing and catalog membership, excludes parcel-priced fields, and performs no automatic billed retries.

Open a private GitHub security advisory for this repository. Do not include live credentials, operational site data, or sensitive infrastructure details in an issue.