# Threat Boundaries

Status: PENDING VERIFICATION

## What This Architecture Handles

- accidental publication of tracked junk;
- broad vendor/content leak through public Git;
- contributor PRs that sneak forbidden folders or binaries into public repos;
- public repos inheriting production Git history;
- unclear reviewer decisions about file classes.

## What This Architecture Does Not Handle

- a trusted person deliberately copying files they can read;
- screenshots, streams, or manual transcription;
- legal claims;
- marketplace platform abuse;
- reverse engineering of shipped builds;
- theft from a compromised workstation.

## Hard Boundary

The only reliable control is not granting a file.

Everything else is detection, delay, or cleanup.

## Technical Controls

- separate repositories;
- fresh Git history for public repos;
- denylist gates;
- narrow allowlists;
- public templates that do not depend on production;
- branch protection and CODEOWNERS;
- manual private integration from public PRs.

## Review Question

For every public candidate file:

```text
If this file is copied forever, is that acceptable?
```

If no, it stays private.