docs/learnings/F007-security.md

• Run deployment containers as a non-root user (for example uid 10001) after chown -R /app to meet least-privilege expectations without breaking runtime file access (F007)