Security — Public surfaces

Three things answer without a login, each reachable only through an unguessable token rather than by knowing an id: public forms, form file uploads, and inbound email addressed to a workspace mailbox. Public forms are treated as hostile input by default. Submissions are rate-limited per address, carry a honeypot and an antiforgery token, and — the important part — the server re-validates which fields are eligible and which were conditionally visible. The browser's account of what the form contained is never trusted, so a modified page cannot write to a field the form did not offer. File uploads hand the browser opaque identifiers only; every piece of file metadata is read back server-side at submission, and uploads that are never submitted are swept automatically.