Security Boundaries

For agents: Keep control-plane credentials outside app code. App-user auth uses host-bound runtime cookies and reserved platform routes.

Planes

• api.userland.fun is the control plane for API keys.
• userland.fun is the product home page.
• *.apps.userland.fun is the app runtime plane.
• docs.userland.fun is public documentation.

Runtime dispatch strips platform headers, ordinary cookies, internal headers, and control-plane credentials before app server code runs.