Static analysis in CI
Security linting and dependency vulnerability scanning run as blocking gates on every change, with findings triaged rather than suppressed in bulk.
Security
A security tool has to hold itself to the standard
The gateway inspects other people's traffic, so how it is built matters as much as what it detects. This is the short version of how it is developed and verified.
Principles
How it is built
Specifics of individual controls live in the documentation and the changelog rather than here.
Reviewed before every release
Each release goes through a multi-pass review of the whole backend rather than only the code that changed. v2026.8.1 was the largest of these so far and is documented in the changelog.
Fail closed by design
Where a control cannot complete, it blocks rather than letting traffic through. A check that fails is not the same as a check that passed, and the gateway does not treat it as one.
Least privilege by default
MCP tools are discovered but disabled until you enable them, roles are enforced with resource-ownership checks, and agent identities have to be registered before they are trusted.
Secrets encrypted at rest
Provider credentials, endpoint secrets, and connector authentication are encrypted on disk and masked in API responses, including responses to administrators.
Sessions you can actually revoke
Logout, role changes, and account disables all take effect server-side and immediately, rather than relying on the client to forget a token. Administrators can list and revoke any active session.
Everything privileged is audited
Administrative actions, policy and settings changes, permission changes, and security events all emit structured audit records that you can export.
Verification
How the code is checked before it ships
An authorization test matrix
A route-by-route authentication and authorization matrix mirrors the production middleware chain, so a route cannot quietly lose its guard without a test failing.
Tests across the data path
232 test files cover the proxy pipeline, policy engine, authentication stack, and database layer, including concurrency behaviour under load.
Reporting
Found something?
Security reports are welcome and are treated as a priority over feature work. Please report privately first and allow a reasonable window before any public disclosure.
What counts as a security issue here?
Anything that lets traffic bypass a control that was configured to stop it, or that lets 1 tenant, team, or user reach another's data.
What is out of scope?
Findings that require an already-compromised administrator account, deployments running with documented safety controls deliberately disabled, and scanner output without a demonstrated impact.
Is there a bounty?
No. This is free software maintained by 1 person. Reports are credited in the changelog unless you would rather they were not.
Test it against your own deployment
Guardrails evaluation scores your configuration against the OWASP LLM Top 10 and NIST AI RMF, on demand.