A client trust boundary is the point in software where a local app decides whether to trust data, identities, or instructions coming from a remote server, peer, or network path. It is a security boundary because anything beyond it can be altered, spoofed, or relayed by an attacker.
In practice, this boundary is enforced by checks such as TLS certificate validation, hostname matching, response authentication, and input verification. If those checks fail, a client may accept a malicious server or unsafe data and still display, store, or act on it. That can lead to information disclosure, session hijacking, or command misuse. Defenders focus on making trust decisions explicit and strict, because a weak client-side check can undermine otherwise encrypted communications. In collaboration tools, for example, note features and other sensitive content depend on the client correctly verifying that it is talking to the real service.