Built to fail closed.
A gateway that holds provider credentials and customer prompts must be safe by default. Unsafe production configuration refuses to start — loudly, before serving a single request.
- Keys you cannot leak backAPI keys are stored as SHA-256 digests and returned exactly once. Scopes narrow by method and path; revocation takes effect immediately. The console has no default credentials — the first visit creates an Argon2id-hashed admin, then setup closes forever.01 returnof plaintext
- Isolation by constructionTenants are separated in routing decisions, cache keys, and Redis namespaces. A cache hit cannot cross tenants because the tenant is part of the key — not a convention, a structure.03 layersisolated
- Secrets referenced, never storedProvider credentials name environment variables or are sealed with AES-256-GCM. Inline secrets on writes are discarded, and synapass config prints redacted. The config file stays safe to commit.0 inlinesecrets kept
- Fails closed in productionProduction mode refuses to boot on a CORS wildcard, a missing admin key, or tracing without an endpoint. Audit logging records every control-plane mutation with before and after values.03 checksenforced
Found a vulnerability?
Do not open a public issue. Report it privately per SECURITY.md in the repository, or via the contact page. Key-material handling, auth bypass, tenant cross-talk, and denial-of-wallet are treated as high severity.