Security

Security is built into every layer. As a module author you inherit guardrails — and there are a few you must uphold.

Authentication #

The core issues short-lived access JWTs and opaque refresh tokens in an HttpOnly cookie. Passwords are hashed with Argon2id. The module only sees the identity injected by the proxy (see lifecycle).

Seccomp sandbox #

The kubuno-seccomp crate forbids the execve call in modules (limited exceptions: files & media). Never reintroduce process spawning.

Data isolation #

• One PostgreSQL schema per module; no tables outside its scope.
• Never connect to the shared DB without explicit agreement; don't go hunting for credentials in config files.

Secrets & headers #

• Refresh tokens live in an HttpOnly cookie; never put secrets in logs/JSON.
• Security headers (HSTS, X-Frame-Options…); /internal/* protected by X-Internal-Secret.
• AES-256-GCM encryption for sensitive data.