Public form boundary

Do not submit passwords, payment details, regulated information, private client records, or confidential project files through a public form.

Private project access should be handled only after scope is agreed and access can be granted, limited, logged, and revoked.