Access and execution security
LeBonTag separates application identity, geographic scope, review responsibilities and operating-system permissions. None of these should be inferred from a client-side visual state alone.
Application access
Authentication establishes the user's session. API handlers check the appropriate role and business access. Territory preferences are validated against assignments. Administrator access, validation responsibilities and quality-rule assignments are separate controls.
Review requests must preserve OSM type, ID and version. The server must not trust a numeric ID, a displayed counter or a browser selection as proof of authority. Current memberships and obligations can differ from those when a page was first opened.
Integration target and evidence
The integration target must be explicitly authorised according to the deployment configuration. The executor also verifies the reference and prepared work. This protects against applying a batch to an unintended database; it is not a substitute for restricted PostgreSQL credentials.
Uncertain execution outcomes require inspection. Automatic retry is intentionally not a safe default after an append might have occurred. Keep journals and run artifacts sufficient to establish what happened.
Native service account
The shipped native services use the dedicated lbt-integration account, including the web, pipeline, integration, segmentation, cleaning and email jobs. The name does not limit it to the integration job.
The account needs read/traverse/execute access to code and tools, and write access only to each unit's required working locations. systemd restrictions such as ProtectSystem=strict and ReadWritePaths add a second boundary. Avoid recursive ownership changes or world-readable secrets to fix an isolated access error.
Installation commands may use sudo while the service process remains unprivileged. Docker has its own container/user and volume model; do not copy native systemd units into containers.
Secrets and personal data
Protect the supported environment files and SMTP encryption key. Do not commit real credentials or expose them through screenshots, rule descriptions, command examples or public logs. Email verification and unsubscribe links contain credentials for their specific action.
Administrative monitoring can reveal user addresses, names, paths and object review history. Redact these when sharing an incident. For deployment permissions and reverse-proxy configuration, follow Installation, not an improvised permissive chmod.