ZeroFare
Console Get started

Security

How ZeroFare protects credentials and traffic.

A factual summary of the controls in the codebase and the running deployment. For the engineering detail, see Security in depth in the docs.

Credential handling

  • Gateway API keys: peppered scrypt hashes (N=216); management credentials: salted SHA-256 digests.
  • Plaintext secrets are printed exactly once at creation and never written to disk — the on-VM seed file carries digests only.
  • Verification compares digests; there is no decryption path anywhere in the codebase.

Network posture

  • Every service binds 127.0.0.1; the only public surface is a hardened TLS reverse proxy (Caddy, auto-HTTPS via Let's Encrypt).
  • Fail-closed auth: missing credentials and unknown routes return identical terse 401s — nothing can be enumerated unauthenticated.
  • Two independent firewall layers (host iptables + cloud security list) gate all inbound traffic.
  • The local edge binds loopback by default and refuses non-local hosts by schema — it cannot be accidentally exposed.

Container hardening

  • Read-only root filesystems; all Linux capabilities dropped; no-new-privileges; non-root user (65532).
  • Container images pinned by digest; .dockerignore keeps secrets, git history, and dependencies out of build contexts.
  • Writable paths are limited to explicitly mounted state and tmpfs scratch.

Verification, not assurance-theater

  • Dedicated tenant-isolation test suite (cross-tenant access attempts must fail).
  • Contract tests against the frozen OpenAPI snapshot for every management route.
  • Load tests with latency gates; property-based tests on console components.
Scope statement: the early-access deployment is a single self-managed VM. We do not claim SOC 2 / ISO 27001 / HIPAA compliance, and the enterprise assurances (SLA, audit export) attach to the paid hosted product in Phase 3.

Reporting a vulnerability

Email security@zerofare.dev with details and reproduction steps. We ask for responsible disclosure: give us a reasonable window to fix before public disclosure, and never test against tenants you don't own.