Security
Project Envelope is being shaped as a neutral sharing layer for project material, so access control and revocation are part of the product surface.
Private by default
Project envelopes should default to unlisted links with explicit access controls.
Revocable sharing
Every shared link should be easy to expire, revoke, or replace from the admin surface.
No secret in URLs
Passcodes and recipient secrets should never be embedded directly in share URLs.
Audit-ready
The app should be ready to record view, unlock, expiry, and revocation events when the data model is added.