Security

Architecture & Data Flow

SentriKat deploys 100% on-premises. Every component, the FastAPI application server, PostgreSQL database, and nginx reverse proxy, runs in Docker containers on your infrastructure. No customer data is ever transmitted externally.

Outbound network connections are limited to public vulnerability feeds and license validation:

• Exploited-vulnerability catalogue, public JSON feed, no authentication required
• Public CVE database, optional API key for higher rate limits
• Vendor advisories, package advisories plus the Red Hat, Microsoft and Debian security feeds
• Software identity catalogue, for matching what you run to a published identity
• License heartbeat, daily call to license.sentrikat.com transmitting only the license key and agent count (no customer data)

All vulnerability feed connections are download-only. No inventory data, vulnerability matches, or user information leaves your network.

For classified or restricted environments, SentriKat supports fully air-gapped deployment with manual feed imports.

Application Security Controls

Authentication

• Password hashing: bcrypt with cost factor 12
• Two-factor authentication: TOTP 2FA (RFC 6238) with encrypted secret storage
• Enterprise SSO: LDAP/Active Directory and SAML integration
• Secure session management with HttpOnly, Secure, SameSite cookies
• Admin API: HMAC constant-time key comparison to prevent timing attacks

Encryption

• Data at rest: AES-256 volume encryption (LUKS/dm-crypt) on the licensing/portal database
• Data in transit: TLS 1.2+ enforced via nginx with HSTS
• Credentials: bcrypt password hashing with a per-password salt, never stored reversibly
• License integrity: RSA digital signatures, offline-verifiable
• Secure cookie attributes enforced across all endpoints

Input Validation & Injection Prevention

• SQLAlchemy ORM, parameterized queries prevent SQL injection
• Pydantic v2, strict input validation on all API endpoints
• CSRF protection, token-based cross-site request forgery prevention
• Content Security Policy headers, X-Frame-Options: DENY, X-Content-Type-Options: nosniff
• Cloudflare Turnstile, bot protection on public forms

Rate Limiting

• API endpoints are individually rate-limited per client (e.g., a handful of requests per minute on activation and license endpoints), rather than one blanket daily/hourly quota
• Agent authentication via API key with per-installation scoping
• Admin endpoints: separate authentication with dedicated API key

Infrastructure Security

• Docker container isolation, each service runs in its own container with limited privileges
• nginx reverse proxy, TLS termination, security headers, request filtering
• PostgreSQL not exposed, database listens only on the internal Docker network, not on host interfaces
• Audit logging, all administrative actions logged with timestamps, IP addresses, and user identification
• Backup & restore, built-in database backup and restore functionality
• Data retention, activation logs automatically purged after 90 days to minimize stored data

License Security

• RSA-signed license JWTs, licenses are digitally signed and verified offline by the agent
• No customer data in license calls, activation and heartbeat endpoints transmit only installation IDs and software inventory hashes
• Installation binding, each license is bound to a specific installation, preventing unauthorized reuse
• Offline verification, agents verify license validity locally using the embedded public key, no network call required after initial activation

Compliance Alignment

SentriKat is designed to help organizations meet the vulnerability management requirements of:

OWASP ASVS Self-Assessment

SentriKat has completed a self-assessment against the OWASP Application Security Verification Standard (ASVS) v4.0.3 at Level 1. All 14 chapters pass with documented evidence per requirement.

This is a self-assessment, not an independent third-party audit. The full evidence tables are published transparently on GitHub for review.

Security Standards & Practices

SentriKat's codebase addresses the following industry-standard security frameworks. These are self-assessed based on the controls documented in our internal security audit.

All claims above are self-assessed. OWASP Top 10 and CWE Top 25 coverage is based on controls documented in our security audit. Security headers can be independently verified against any SentriKat deployment.

Dependency Transparency

Every library and dependency that SentriKat relies on is continuously audited against the package, exploited and identity databases. We publish the results here so you can verify our supply chain integrity yourself.

We believe a security tool should demonstrate the same standards it enforces. Our automated pipeline scans all Python and Node.js dependencies daily and updates this page with the latest findings.

Every pull request runs scripts/ci_dependency_gate.sh, which counts the open issues in each project by severity and fails the build if a count grows. The thresholds live in that file and can only be lowered, so something we have closed cannot come back unnoticed. A second check, scripts/check_published_scan.py, reads this page and fails the same build when it stops matching what the tools report, which is how a hand-written page is kept from ageing in silence.

Responsible Disclosure Policy

We welcome security researchers and appreciate your help in keeping SentriKat and our users safe. If you discover a security vulnerability, we encourage you to report it responsibly.

How to report, our response-time commitments, safe harbor, and the full in-scope/out-of-scope list are maintained in one place so they cannot say two different things: our Responsible Disclosure Policy. Reports go to [email protected], PGP key available on request.

Recognition

We maintain a Hall of Fame for security researchers who responsibly disclose valid vulnerabilities. With your consent, we will publicly credit you when the fix is released. If you prefer to remain anonymous, we will respect that.