Skip to main content
Security

Security at Secuvon

Secuvon uses encrypted provider-key storage, access controls and audit records. The controls and current release limits are described below.

66

Documented Threat Models

Fernet

API Key Encryption (AES-CBC + HMAC)

bcrypt

Password Hashing (12 rounds)

Encryption at Rest

  • API keys encrypted with Fernet (AES-128-CBC + HMAC-SHA256)
  • Selected scan evidence fields encrypted before storage
  • Current production database connections are configured to require TLS
  • Runtime secrets are loaded from deployment environment variables

Authentication & Access

  • Passwords hashed with bcrypt (12 rounds)
  • JWT access tokens (30min) + refresh tokens (7 days)
  • Token revocation via JTI blacklisting
  • Rate limits on selected public and authentication routes; trusted-edge client identity remains an operational gate

Network Security

  • MVP scans use fixed hosted-provider endpoints; customer-supplied URLs are unavailable while custom-target SSRF controls are validated
  • CORS restricted to allowed origins only
  • TrustedHost middleware against host header attacks
  • Security headers: HSTS, CSP, X-Frame-Options, X-XSS-Protection

Data Protection

  • Current hosted deployment uses a U.S. Railway region; customer data-location terms require review
  • Provider secrets are never returned by agent or credential responses
  • Data access and erasure requests are handled under applicable rights; custom retention controls are not in the current MVP
  • Security-relevant actions are logged for review; audit records are not independently signed or write-once

Application Security

  • Pydantic validation for typed API inputs
  • Parameterised database queries (SQLAlchemy ORM)
  • Backend and frontend container images define non-root runtime users
  • Multi-stage Docker builds (minimal attack surface)

Incident Response

  • Vulnerability reports by email to the security contact in our security.txt; we aim to acknowledge within 3 business days
  • Production alert delivery and named on-call response remain launch validation gates
  • Audit events for authentication and security-sensitive operations

Responsible Disclosure

Found a security vulnerability? Please email security@secuvon.ai. We aim to acknowledge reports within 3 business days. Please do not disclose an issue publicly until we have had a reasonable chance to fix it; remediation timing depends on severity. The same contact is published in our security.txt.

We do not pursue legal action against researchers who follow responsible disclosure practices.