Audience: Security reviewers, architects, and enterprise buyers.
Security
Fail-closed behavior, cryptographic controls, secret handling, deployment security, RBAC, and audit verification.
Guide
Customer-Operated Security
Policy, key material, audit storage, admin sessions, license files, and deployment configuration remain under customer custody.
Fail-Closed Controls
Policy load failures, audit unavailability, invalid required secrets, unsupported providers, and malformed enabled configuration fail closed.
Safe Support and Evidence
Public support and operations surfaces expose safe metadata only. Raw payloads, private keys, authorization headers, cookies, stack traces, and full environment dumps are excluded.
Authoritative Sources
These repository documents remain the source of truth for implementation details.
Security model
Threat boundaries, authentication, RBAC, fail-closed behavior, and security controls.
docs/SECURITY_MODEL.md
Gateway is designed to reduce sensitive-data egress through deterministic proxy enforcement and auditable decisions. This model describes intended controls and explicit limitations.
Threat model addendum
Threat assumptions and limits.
docs/THREAT_MODEL_ADDENDUM.md
Addendum to `docs/SECURITY_MODEL.md` for production Kubernetes/VM deployments after Milestone 15. This does not replace the core security model.
Audit ledger
Audit integrity and verification.
docs/AUDIT_LEDGER.md
Milestone 4A adds an isolated SQLite audit-ledger foundation. The ledger is append-only and cryptographically tamper-evident.
Supply chain
Dependency, build, and release hygiene.
docs/SUPPLY_CHAIN.md
SBOM generation, dependency inventory, release signing, and verification guidance for GeoCordon.
Production hardening
Security deployment checklist.
docs/PRODUCTION_HARDENING.md
Milestone 15 production hardening for customer-operated GeoCordon (Gateway) deployments.