Security

Public forms are submitted through backend routes. Service-role credentials remain server-side only and submissions are not publicly readable.