A trust boundary is the line between two zones with different trust levels. Every authentication and authorization check exists to enforce one. Naming them explicitly is the fastest way to spot security holes.
The solo dev's five trust zones
| Zone | What is inside | Trust level |
|---|---|---|
| 1. Your hardware | Mac, phone, hardware key | Highest — if compromised, all bets are off |
| 2. Your tailnet | Your devices and servers reachable via Tailscale | High — but lost phone = a stranger is in zone 2 |
| 3. Your authenticated session | App after PIN entry | Medium — valid for 30 days, IP-bound, revocable |
| 4. Your local LAN (home Wi-Fi) | Devices on the same router | Mixed — includes guests, IoT, your kid's tablet |
| 5. The internet | Everyone else | Zero — hostile until proven otherwise |
Where the boundaries live
- Internet → tailnet — Tailscale's WireGuard handshake (Track 4).
- Tailnet → session — The PIN layer (Track 5).
- Session → admin — An additional check inside the PIN-authed session for sensitive routes (Track 8).
- LAN → host — Local IP bypass: skip the PIN if the request comes from
127.0.0.1or specific LAN IPs (a deliberate convenience trade).