Zero runtime egress
There is no telemetry, no licence ping, no remote generation and no crash reporting. The one outbound connection is the model download. It opens only when the host explicitly allows it and an administrator picks a model in the panel. It reaches allow-listed hosts only. Compose networks are internal. Only the edge network routes out, for the api and the gateway. The no-egress gate in CI verifies on every PR that the product source carries no telemetry SDK and no model-vendor host.
Supply chain
Every image is built on native runners for amd64 and arm64. It is published to GHCR by digest and carries an SBOM per architecture. Images are signed keyless with cosign. Third-party images (Postgres, Valkey, vLLM, SPIRE) come from the vendor’s mirror with byte-identical digests. Every checksum file is signed. The install kit verifies its own signature. A release is a git tag. The same workflow dry-runs before the tag.
Licence
The licence is an Ed25519-signed JSON document. The verification keys are compiled into the image. No environment variable can add one. Signing is a single workflow in a reviewer-gated GitHub environment. The installation keeps a clock mark that never moves backwards. Clock rollback is refused. Transaction metering is chained into the ledger. Deleting rows can only raise the count. The document may bind to the installation id. A foreign document is refused.
Identity
People sign in with the organisation’s OIDC provider (discovery, PKCE, role mapping, front- and back-channel logout). Installs without an IdP use local accounts and TOTP, which also serve as break-glass. Callers hold tenant-bound API keys. Workloads present SPIFFE X.509 and JWT SVIDs. These are verified from trust-bundle files only. MCP servers can be pinned by SPIFFE id. Optional mTLS runs between the api and the detectors. XFCC is accepted only from named trusted proxies.
Safe defaults
The .env templates are production-safe and every secret is generated. The bootstrap token is single use. No session exists before the first administrator. Postgres, Valkey and the detectors are not published to the host. Prometheus listens on loopback only. Security rails ship with a closed posture. The sector templates’ critical rails are locked. Tenant isolation applies on every table. A foreign row returns 404.
Isolation
File analysis runs in a separate child process per file, with memory and time limits. YARA’s pe/elf/dotnet modules load only in that child. CodeShield’s Semgrep half runs in its own process group without network. The detector sidecar can run under gVisor. Model weights are verified against the signed manifest at start.
Logs and data
Logs carry no raw content. pino redacts. The ledger stores hashes in place of content. The redacted sample is at most 2 KB and is deleted at the end of retention. Unless a tenant pack opts in, no prompt is written to disk in plain text. A tenant leaving receives a signed certificate of deletion.
Continuous verification
Every PR runs the backend, frontend, detector, eval, red-team, contract-validation, no-egress and image-build jobs. Every e2e suite runs on real Postgres. The acceptance job runs the install kit end to end. The security audits (policy integrity, licence integrity, SSRF/ReDoS, gateway and MCP) were closed in 0.5.0. Their findings are written up in the decision records.