Application controls
HttpOnly sessions, CSRF-safe server actions, CSP, clickjacking protection, input validation, and least-privilege authorization on the server.
Security
No magic public case links, guessable identifiers as security boundaries, shared generic accounts, or permanent attachment URLs.