Docs/Operate
Security
The Rust and Dioxus implementation reduces classes of defects; the security boundary still comes from explicit authentication, authorization and isolation.RustyAuth is not yet qualified as the sole identity system for production. Account recovery, abuse controls, multi-writer review, broader authenticator coverage and an independent assessment remain release gates.
Core assumptions
- The Dioxus dashboard is an untrusted presentation client.
- The Rust backend is the authentication and authorization boundary.
- SableDB and backup storage remain private infrastructure.
- Fleet operators are powerful principals; their access must be passkey-bound, scoped and audited.
- Protobuf is a contract and encoding—not encryption, identity or authorization.
Control map
| Boundary | Controls |
|---|---|
| Browser | Exact origins; HttpOnly SameSite cookies; CSP; frame denial; bounded bodies and timeouts |
| Operator | Passkeys; server-side scope authorization; recent-auth checks; durable audit |
| Service | Short-lived scoped credentials; TLS/mTLS or workload identity; versioned Protobuf |
| Datastore | Private networking; no browser access; encrypted signing material; atomic mutations |
| Recovery | AES-256-GCM snapshots; provider encryption; Object Lock; empty-target restore |
| Supply chain | Non-root containers; pinned dependencies; signed release direction; CI recovery drill |
Secrets and credentials
Commit non-secret YAML policy. Inject independent master keys, backup keys, bootstrap values and service credentials through the platform secret store or _FILE mounts. Never store realm connection credentials in browser storage, logs or ordinary desktop configuration. Fleet encrypts scoped realm credentials at rest; native clients use the OS keychain for their own short-lived tokens.
Server-side authorization
Every organization, project, environment, realm, operator and service-account operation is authorized again in the backend. Tenant identity and scope come from verified server-side context—not a client-provided label. Recent-passkey requirements protect sensitive mutations, and raw session values are never persisted.
Network and SSRF posture
Keep backends and datastores private. Fleet management and webhook URLs are outbound request targets: validate scheme and normalized host, resolve DNS, block loopback/private/link-local destinations unless explicitly permitted, prevent redirect escape and revalidate connections. RustyAuth requires HTTPS webhook URLs and disables redirects, but production still needs an egress allowlist or proxy to close DNS-rebinding paths and express reviewed private-network exceptions.
Release gate
- Complete recovery and abuse-control design.
- Qualify cross-process mutation safety and supported replica counts.
- Expand browser, authenticator, protocol-negative and authorization tests.
- Generate and verify SBOM, provenance, signatures and dependency policy.
- Complete an independent threat-model and implementation review.
- Run disaster recovery with escrowed keys and a real post-restore passkey sign-in.
Use the normative security policy and threat model and the hardening checklist. Report vulnerabilities through the private channel described there—not a public issue.