Noema treats every external byte as hostile, every action as something that must pass policy, and every secret as something that must never come back out. This page reproduces the security model, the authentication design and the threat model with the test that verifies each mitigation.

{{include SECURITY.md}}

## Threat model

{{include THREAT_MODEL.md demote=1}}