Is there a document describing the architecture and security model?

Edit: There's an image that mentions WebSockets. Is it using the same one-time token approach to security as NeutralinoJS[1]?

[1] https://neutralino.js.org/docs/contributing/security/