Everything the team shares,
nothing anyone shouldn't see.

// authorization checked server-side on every request