PROBLEM
Learning security is not the same as proving you can do security work.
The product is built around a recurring career gap: learners may understand cloud security concepts and earn certificates, but still struggle to practise realistic work, receive contextual feedback and produce credible evidence of what they can do.
SECURITY ARCHITECTURE
Publish the reasoning without publishing the attack surface.
The public repository documents a sanitised logical architecture while the production application source remains private. Browser, application server, database, evidence storage, AI provider, payment provider and operational monitoring are treated as distinct trust zones.
Authentication is not treated as sufficient authorisation for learner-owned data.
PostgreSQL RLS is part of the defence-in-depth authorisation model.
Learner artefacts require explicit ownership and protected access paths.
Security events, deployment controls, backup and restore are included in the architecture.
SECURITY DECISION RECORDS
Document why a control exists, not just that it exists.
The public architecture includes formal ADRs for PostgreSQL RLS, learner evidence ownership, server-side privileged secrets, non-authoritative AI output and payment-provider verified entitlement.
Each ADR records context, decision, benefits, trade-offs, rejected alternatives and the validation required before the decision is treated as effective.
IMPLEMENTATION-BACKED VALIDATION
The product is live. Validation now follows the controls that matter most.
An early implementation-backed review confirmed a real server-side provider-secret boundary: privileged provider credentials were consumed on the trusted server path, browser code called the application API rather than the provider directly, provider errors were sanitised before logging, and test fixtures used non-secret values.
Now that The Cloud Forge is live, the validation programme moves deeper into the product itself: learner-to-learner RLS isolation, evidence ownership, AI authority boundaries, payment entitlement, privileged administration and security logging. The public architecture deliberately separates controls that are implemented from controls that have been runtime-validated.
AI SECURITY BOUNDARIES
The coach can guide the learner without becoming an unrestricted authority.
AI output is treated as non-authoritative application output. Security-critical entitlement, ownership and privileged operations remain outside unrestricted model control, and sensitive actions require trusted product logic to validate the request.
EVIDENCE DISCIPLINE
Public security evidence should be useful without exposing proprietary implementation.
The repository separates documented architecture, implemented patterns and validated controls. Sanitised SQL, logging and server-boundary examples demonstrate security principles without revealing private schemas, credentials, learner data or exploitable production detail.