ReplyBox security rests on tenant isolation, RBAC, httpOnly cookies, HMAC internal callbacks, encrypted session/media storage, and careful production secret handling.
organization_id on user-facing rows.require_permission() on REST endpoints.CHANNEL_SESSION_KEY.MEDIA_OBJECT_KEY.