Skip to content
stratldocs
Open the portal
Developer docs

Security, for engineers

Engineers6 min read

The public security page states the design and lists what is in place and what is not. This page is the engineering side: what the repositories actually enforce. Every claim cross-linked.

On every change

Section titled “On every change”

CI in each repository runs lint and tests, then a security job: gitleaks over the full git history, pip-audit on the exported Python lockfile, pnpm audit at the high level, and govulncheck on the Go verifier. A high or critical dependency finding fails the build. Dependabot opens weekly upgrades for Python, npm, Go modules and GitHub Actions. The backend also runs the conformance check that Python, TypeScript and Go hash every golden fixture identically.

Fake keys in test fixtures are allow-listed by path in .gitleaks.toml; nothing else is.

What the service can never do

Section titled “What the service can never do”

These are written into the code and the deployment templates, not policy documents:

  • Hold a private key. Signers hold public keys only; the key service signs. Every signer verifies the returned signature before anything is written.
  • Delete from custody storage. The IAM policy (managed) or the granted identity (customer) has put and get only. The take-custody probe tries a delete and refuses the configuration if it succeeds.
  • Put content in the index. Records carry fingerprints; artifacts go to custody storage. The index holds fingerprints and metadata.
  • Log content. Logs carry paths, ids, statuses and errors.
  • Sign in with the database. Codes are stored as HMAC with a server-side pepper, sessions and keys as SHA-256.

Secrets

Section titled “Secrets”

Everything arrives as an environment variable or a secret reference. api/.env.example documents every variable and contains no values. Production refuses to start with the default STRATL_SECRET_KEY. Connector credentials are references (env:NAME, aws-sm:ARN) resolved at use; customer-cloud credentials for taking custody are an assumed role with an external id, or references, never stored values.

Sessions and rate limits

Section titled “Sessions and rate limits”

Passwordless sign-in: six-digit codes, ten minutes, five attempts, one per minute and five per ten minutes per email. Sessions are HTTP-only, SameSite=Lax, secure in production, 30 days. Expired codes and sessions are purged automatically. Invitations carry a 256-bit token stored as a hash, valid seven days and once, and require the invited mailbox.

Reporting a vulnerability

Section titled “Reporting a vulnerability”

Email hello@stratl.ai with “Security report” in the subject. A person reads it, replies within three working days, and gives you a fix or a plan with a date. Good-faith research that follows the rules in SECURITY.md (no customer data, no workspaces that are not yours) is welcome and never met with legal action. Do not open a public issue for a security problem.