# Security boundary

HTTP cache mistakes can expose authenticated or private data. MoonHttpCache
therefore fails closed for unsafe field values, shared-cache `private`, restricted
`Authorization` responses, `Vary: *`, ambiguous numeric directives, and
conflicting 304 entity tags.

## Input limits

- Scenario JSON is limited to 1 MiB and 1,024 header lines.
- Cache-Control and header processing is iterative rather than recursive.
- Delta-seconds and age calculations saturate at 2^31 seconds.
- Header values containing NUL, CR, or LF produce error diagnostics.
- Cross-origin Location and Content-Location values are excluded from automatic
  invalidation targets.

## Caller responsibilities

- Parse HTTP framing correctly and remove hop-by-hop fields before integration.
- Store bodies atomically with their metadata and prevent cache poisoning.
- Partition private caches and protect credentials and stored content.
- Supply a trustworthy monotonic-enough wall-clock timestamp.
- Perform actual network validation and honor the returned action.
- Add a non-zero Age and appropriate stale warning behavior when serving stale.

The library is a semantics component, not a sandbox, HTTP parser, authorization
system, or complete cache. Report security issues privately to the repository
owner before public disclosure.