Security

Security Advisories

KyriosForge is built around a small, auditable attack surface — an isolated signing authority, no phone-home telemetry, and offline license enforcement. This page is where we publish known vulnerabilities affecting the product, and how to report one.

Reporting a vulnerability

If you believe you’ve found a security issue in KyriosForge or the account portal, please email admin@axialsolutions.io with a description and, if possible, steps to reproduce. Please don’t open a public forum post or GitHub issue for anything you believe is exploitable — email first.

We don’t yet run a formal bug bounty program, but we credit reporters by name (or anonymously, your choice) in the advisory once a fix ships, and we ask for a reasonable window to patch before any public disclosure.

Memory safety

The hub and agent are written in Rust, which eliminates buffer overflows, use-after-free, and similar memory-corruption bugs at compile time — not just mitigates them. Every workspace crate forbids unsafe code at the compiler level except one deliberate, named exception (a PAM authentication FFI shim, isolated to a single file). Memory safety doesn’t eliminate every bug class — logic errors and malicious input handling still matter, which is what the rest of this page and the reporting process above are for.

Published advisories

Each advisory lists what’s affected, the severity, and the version it was fixed in. We publish these regardless of whether the issue was found internally or reported externally.

No advisories have been published to date.

Dependencies & included libraries

The list below is every direct runtime dependency of the KyriosForge hub and agent — the software you actually run — grouped by what it does, weighted toward the categories that matter most in a security review (cryptography, TLS, archive extraction, native FFI). It’s not the full transitive closure; see the link below for that.

Cryptography & signing

  • ed25519-dalek 2 (license signature verification)
  • crypto_box 0.9 (X25519 sealed boxes -- activation handshake, rehost receipts)
  • aes-gcm 0.10 (symmetric encryption)
  • rustls 0.23 / rustls-acme 0.15 (TLS, incl. automated cert issuance)
  • sha2 0.10 / hmac 0.12 / subtle 2.6 (hashing, MAC, constant-time comparison)
  • bcrypt 0.15 (console password hashing)
  • rand 0.8 (CSPRNG)

Networking & transport

  • tonic 0.12 (gRPC, hub <-> agent)
  • axum 0.7 / axum-server 0.8 (HTTP/WebSocket console API)
  • hyper 1 / hyper-util 0.1 (reverse-proxy gateway, Docker socket auth)
  • tokio-tungstenite 0.24 (exec-bridge WebSocket client)
  • reqwest 0.12 (outbound HTTPS, rustls-tls only)
  • tower / tower-http 0.5 / 0.6

Container & orchestration clients

  • bollard 0.17 (Docker Engine API)
  • kube 0.96 / k8s-openapi 0.23 (Kubernetes read client)

Archive & file handling

  • tar 0.4
  • flate2 1
  • bzip2 0.4
  • xz2 0.1
  • zip 2
  • sevenz-rust 0.6

Auth & directory

  • ldap3 0.11 (rustls-tls only)

Data & config

  • sqlx 0.8 (PostgreSQL / SQLite)
  • redis 0.27
  • serde / serde_json / serde_yaml
  • toml_edit 0.22

Native / FFI

  • libloading 0.8
  • libc 0.2

Core runtime

  • tokio 1 (full)
  • futures / futures-util 0.3

Embedded console (Vue)

  • vue 3.5
  • vue-router 4.5
  • vue-i18n 11.4
  • @xterm/xterm 6.0 (in-browser terminal)
  • yaml 2.9

We track upstream security advisories for these libraries and patch promptly when one affects us. For the full linked dependency closure with per-library license text — regenerated from the actual build, not hand-maintained — see Third-party licenses & attribution.