Security Model

Formerie treats the browser as an untrusted input surface. The runtime API owns routing, provider credentials, templates, delivery rules, validation policy, and submission acceptance.

Client Boundary

Browser clients submit only:

• form field values
• human-verification tokens when required
• safe first-party metadata such as page URL or idempotency key

Browser clients never submit recipients, provider credentials, provider names, sender identities, email templates, delivery rules, or server-side validation rules.

Public Schema

The public schema endpoint is an allow-list projection of the server-managed form. It can expose field labels, types, validation hints, public steps, conditional visibility rules, and browser-safe verification settings. It does not expose delivery configuration, secrets, allowed origins, fallback providers, rate-limit rules, or internal risk signals.

Server-Owned Configuration

Each workspace form resolves to server-owned configuration before validation and delivery. This keeps sensitive workflow details out of public markup, hosted pages, embeds, and SDK bundles.

Auditability

Submissions should produce predictable events that can be inspected by customer dashboards and delivery logs.