The backend's own boundary, the hardened desktop application, and opening projects saved by another version. The application is a web interface talking to a backend process, so that backend is itself something that has to be defended. On the desktop it binds 127.0.0.1 — the loopback interface — so nothing on your network can open a connection to it at all. Every /api request must carry a token generated from 32 cryptographically random bytes on first run and stored in your user profile; the desktop app supplies it automatically, and anything that does not have it is refused — and refused BEFORE its body is read, so an unauthenticated caller cannot make the backend parse or buffer anything.
This site needs JavaScript for the full experience. Every page above is reachable without it.