Security model

The desktop app connects to Kubernetes with the selected kubeconfig identity. Kubernetes RBAC and admission remain authoritative. Lumen stores UI preferences, workspaces and local activity needed for the interface; inspect your platform’s app-data location and organizational policy before using sensitive clusters.

Secret resources are redacted in supported views. Incident evidence and exports apply best-effort credential-pattern redaction, but operators must review previews before sharing. Lumen does not claim blanket compliance or that every byte always remains local: credential plugins, Kubernetes endpoints, registries and update checks have their own network behavior.

Protected contexts, read-only mode and confirmations are safeguards against accidental actions. They are not an authorization boundary.

Source: docs/OPERATOR_SAFETY.md, src/lib/incidentReport.ts, src/state/uiSettings.ts, src-tauri/src/k8s/kubeconfig.rs at v0.18.0.