Security

Security Policy

Supported Versions

Version	Supported
Latest on main	Yes
Older releases	No

Reporting a Vulnerability

Do not open a public GitHub issue for security vulnerabilities.

Email the maintainer directly: rgumieri@gmail.com with subject [Nenya Security] <brief description>

Include:

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Suggested fix (optional)

What to expect:

1. Acknowledgment within 48 hours
2. Initial assessment within 5 business days
3. Resolution timeline communicated based on severity
4. CVE assignment for critical vulnerabilities
5. Coordinated disclosure once a fix is released

Secure Memory Storage

Nenya stores authentication tokens in RAM-locked memory to prevent sensitive data from being written to disk:

• mlock/mmap: Tokens allocated using syscall.Mmap with syscall.Mlock
• Zero-fill on destroy: Memory zeroed before release via syscall.Munmap
• Constant-time comparison: Uses subtle.ConstantTimeCompare to prevent timing attacks
• No string copies: Tokens stored as []byte slices, not Go strings

Deployment Requirements

[Service]
LimitMEMLOCK=infinity

Without this setting, mlock will fail and the gateway reports ErrMLockFailure.

Rate Limiting

Authentication attempts are rate-limited per client IP to prevent brute-force attacks.

Security Architecture

Deployment Hardening

• Non-root execution: Runs as UID 65532 with dropped capabilities
• Memory protection: IPC_LOCK for mlock; prevents secrets from swapping
• Read-only filesystem: Immutable root + private /tmp
• Seccomp + no-new-privileges: Restricted syscalls, prevents privilege escalation
• Socket activation: Seamless restarts with zero dropped connections

Pipeline Security

• Tier-0 regex filter: Always-on redaction of AWS keys, GitHub tokens, passwords, etc.
• Body limits: MaxBytesReader prevents memory exhaustion
• Header sanitization: Hop-by-hop headers stripped before proxying

Role-Based Access Control (RBAC)

Nenya enforces per-API key access controls via RBAC. API keys defined under api_keys in secrets support:

Roles:

• admin — Unrestricted access (bypasses RBAC)
• user — Access to configured agents, all non-admin endpoints
• read-only — GET requests only

Agent Scoping:

• allowed_agents restricts which agents the key can access (empty = all agents)
• Admin keys bypass agent restrictions

Endpoint Restrictions:

• allowed_endpoints allowlists fine-grained method + path access (e.g. GET /v1/models)
• Overrides default role permissions when set
• Admin keys bypass endpoint restrictions

Metrics: nenya_auth_denials_total with reason label.

See Secrets for configuration examples.

Scope

Security vulnerabilities include but are not limited to:

• Authentication/authorization bypasses
• Request smuggling or HTTP desync attacks
• Denial of service (resource exhaustion)
• Information disclosure (leaked secrets, headers, or internal state)
• SSRF or injection vulnerabilities

Issues outside scope (feature requests, bugs without security impact) should be reported via GitHub Issues.

See Also

• Disclaimer — Usage terms and liability
• Secrets — Secure token storage