If you find a security issue, please report it privately to tc@9rese.com rather than opening a public issue. We'll acknowledge and work on a fix promptly.

mom is a private, self-hosted family app. Each deployment runs in its own Firebase/GCP project with its own data — there is no shared backend. It is not HIPAA-certified; if you store health data, secure your GCP project accordingly (least-privilege IAM, audit logging, billing alerts).

• Never commit secrets or patient data. The .gitignore excludes .env, .firebaserc, firebase_options.dart, google-services.json, GoogleService-Info.plist, service-account keys, keystores, docs/research/*, and *.private.*. Verify with git status before every commit.
• Production secrets (e.g. any non-Vertex API keys) belong in Google Secret Manager, read only by Cloud Functions — never shipped to the client.
• Vertex AI / Gemini calls happen server-side in Cloud Functions so credentials never reach the Flutter client.

• All access requires Firebase Auth (email/password); no anonymous reads.
• Firestore & Storage security rules enforce role-based, per-patient least privilege (docs/architecture/01-system-design.md §11). Embeddings and source documents are written only by Cloud Functions (Admin SDK); clients never write vectors.
• Replace the default time-limited Firestore test rule with the project rules before deploying.

Keep Flutter/Dart and Python dependencies current. Run flutter pub outdated and review functions/ deps periodically.