API level: All REST request bodies and path parameters are checked through schema validation. Invalid requests are rejected before reaching the business logic.

Database level: Only parameterized queries — no string concatenation, no raw SQL. This prevents SQL injection by design.

WAF level: JSON content-type is enforced on API requests. Known injection patterns are automatically blocked.

Frontend level: Vue 3 auto-escaping in templates. Secure DOM handling for HTML content (no direct insertion of raw HTML).

File uploads: Size and type checks — the file type is detected from the file content, never from the file name; archives, folders and mailboxes, where they are enabled for your workspace, are unpacked with hard limits (at most 500 entries per archive, at most 100 times the archive size but always at least 32 MB, and at most 8 GB unpacked, no single file over 2 GB), and web pages and XML are rendered without any network access.

Error handling: Error messages contain no stack traces or internal details. 404 and 403 responses are returned without a body. Error reports are automatically cleansed of PII.