Security model

This page carries the premise every other rule follows from, the three properties Postern holds by design, and the honest account of what has not been reviewed. Each subject below has its own page.

​

The trust boundary

Postern serves one person on one machine. It is not a shared service, and every rule on every page above follows from that. Anyone with a login on that machine already holds the database, the vault key file and your browser. Postern defends nothing against them. Postern opens two ports, and it opens both to this computer only. Only this computer can reach these addresses. Nothing on your Wi-Fi, and nothing on the internet, can. The database gets no port at all. Which computers can reach Postern carries both ports, what protects each route group, and the one line in docker-compose.yml the whole claim rests on. Postern is open source, so you do not have to take any of this on trust.

​

What Postern enforces by shape

Three properties hold by design:

• The resolved identity is the first argument of every function that returns data, and the sector check runs before any SQL. Postern scopes every read to the user on that identity. No path reads without one.
• A secret never lives in a row. A credential row carries a pointer into the vault and nothing more. A domain row carries no pointer at all.
• An unknown sector fails closed. Postern refuses a target whose first word is not one of the six sectors. A typo therefore never maps onto a grant you did give.

SECURITY.md in the repository carries the project’s full list. It covers properties this page has not verified line by line.

​

The record

Postern writes every agent read and every action to the record. It records what happened; it never stops anything, and no call waits for a line to land. That makes the record the compensating control for everything a grant cannot express, and it is the reason nothing on this page claims to prevent an agent from misbehaving. The record covers what your agents did, not what you did to your agents. Six acts leave no row at all. They are: create a key, rotate one, edit its sectors or its deadline, revoke it, delete it, and set a connection’s sync window. Keep your own note of those. What does not get a row lists them. Postern redacts credential-shaped arguments before it stores them. What the arguments hold names the fields and the cap. The audit log carries what a row holds and what gets one. Nothing in the database stops a row being changed or deleted, so the record’s integrity rests on the application and on your own Postgres roles — the honest limits.

​

What has not been reviewed

Nobody outside the project has audited this code. There has been no external security review and no penetration test. The review in the repository’s own history is internal — the same people who wrote the code, who then read it again. One known question sits inside that gap. The push-ingest secret is the only comparison in Postern that takes the same time whether the value is right or wrong. Postern hashes agent keys and OAuth-bridge tokens with SHA-256 and looks the digest up in Postgres by equality, which does not have that property. The database compares a digest of the presented value rather than the value itself. We do not know whether that difference is reachable across a network, and the project has published no analysis of it. Postern is pre-1.0. The supported version is the latest release. Fixes go into the next release, and older releases do not get them, so update to stay fixed. To report something, use GitHub’s private vulnerability reporting on the postern repository. It opens an advisory only the maintainers can see. There is no security mailbox, and an exploitable finding should not go in a public issue. Read the scope section of SECURITY.md first. Two properties sit on its out-of-scope list on purpose. The admin routes carry no per-request authentication when a caller reaches them from this computer, and Postern does not encrypt the cached data at rest.

​

What you have now

One line you can state flatly. Your credentials are encrypted and your data is not, and both ports stay opened to this computer only until you decide otherwise. Three standing costs come with that. The Console port’s protection is its address, so anything that widens which computers can reach it removes the protection entirely. The vault key file is the whole secret, so your copy of it is the only recovery path there will ever be. And nobody outside the project has reviewed any of this.

​

Next