Security Policy This application has no database credentials and no direct database access. Session tokens are stored in sessionStorage, not localStorage, and are cleared on any 401 response. All authorization is ultimately enforced by annlite-backend — this admin UI's own role checks are a UX convenience, not a security control. Report vulnerabilities per the organization SECURITY.md — administrative access-control bypasses are treated as critical.