Security
Private pages are noindex, sessions are HttpOnly, and the BFF never exposes backend secrets.
Enterprise-ready principles
- Existing FastAPI contracts remain authoritative.
- Private provider routes are excluded from search indexes.
- Protected health information is not placed in public metadata or analytics.
- Unsupported server-dependent actions remain feature-gated.
- Desktop, tablet, mobile and keyboard workflows are supported.