MoonSCIM processes identity data but is not an identity security boundary by itself. Deployments must add transport, authentication, authorization, persistence, and operational controls appropriate to their threat model.

• JSON decoding is bounded by configurable input characters, nesting depth, and total value nodes before a MoonSCIM value tree is allocated.
• Object keys that collide case-insensitively are rejected, preventing one component from validating userName while another consumes USERNAME.
• Malformed paths, filters, cursor tokens, schemas, Bulk dependencies, and PATCH targets return typed errors rather than partial mutations.
• PATCH is atomic at the value level: a failed later operation exposes no partially updated result.
• Public collection accessors return copies, reducing accidental shared-state mutation across requests.
• Bulk cycles and unresolved references are rejected before execution.

An Internet-facing service must provide all of the following:

1. TLS and authenticated clients, normally OAuth bearer tokens or mTLS.
2. Per-resource and per-attribute authorization before reads and writes.
3. Request-body, request-rate, timeout, and concurrency limits in addition to codec budgets.
4. Transactional uniqueness for attributes such as userName, and optimistic concurrency for meta.version/ETags.
5. Signed or encrypted RFC 9865 cursor tokens. The built-in deterministic token only detects query mismatch; it is not a message authentication code.
6. Audit events that avoid logging passwords, bearer tokens, or unnecessary personal data; retention and deletion policies must follow local law.
7. Correct filtering of writeOnly values from responses and enforcement of returned behavior in the application response path.
8. Database query parameterization if a compiled filter is translated into SQL or another query language. Never concatenate user filter text.

• The standalone filter evaluator compares strings case-insensitively. A host that needs custom-schema caseExact=true behavior must use a schema-aware comparison adapter.
• Validation describes resource shape and transitions; it cannot prove access rights, cross-resource references, global uniqueness, or storage durability.
• Bulk planning does not create a distributed transaction and does not execute failOnErrors; the adapter controls commit/rollback behavior.
• JSON budgets are measured in MoonBit string code units, not HTTP wire bytes. The HTTP layer should enforce a byte limit before UTF-8 decoding.
• The package does not normalize Unicode identifiers. Deployments should define normalization, spoofing, and confusable-character policy for login names.

• Keep default codec budgets or reduce them for the endpoint's expected shape.
• Cap filter source length, collection count, Bulk operations, and PATCH count.
• Apply authorization before projection so hidden attributes cannot affect observable sorting or error differences.
• Sign cursor state and bind it to tenant, subject, expiry, and query.
• Treat SCIM passwords as secrets even when the downstream provider hashes them; never include them in logs or error detail.
• Run all negative and cross-target tests after changing a schema or adapter.

Security reports should be sent privately to the maintainer before opening a public issue. Do not attach real identities, access tokens, or production SCIM payloads to a report.