Security

Security isn't a feature. It's the foundation.

Every design decision in Vane starts from a threat model. Here's exactly how we protect your agents.

Cryptographic primitives

Built on proven cryptography.

ED25519

Ed25519 Signatures

Industry-standard elliptic curve signatures. Every passport and attestation is signed with Ed25519 — the same algorithm used by SSH, TLS 1.3, and Signal. 128-bit security level. Deterministic. Fast.

AES-256-GCM

AES-256-GCM Encryption

Envelope encryption for all sensitive credential material. AES-256-GCM provides both confidentiality and authenticity. Credentials are encrypted at rest in PostgreSQL with a separately-stored master key.

SHA-256

SHA-256 Merkle Tree

An append-only SHA-256 binary Merkle tree anchors every attestation. Any inclusion proof is verifiable offline with only the CA public key — O(log n) verification, no network call required.

Verification model

Verify without trusting us.

The usual way

Most identity systems require you to call our API to verify a credential. If our servers are down, your verification fails. If our database is compromised, your audit trail is worthless.

The Vane way

Vane passports verify offline. Given a passport, an inclusion proof, and our CA public key — all public information — any third party can independently verify any agent action. No network call. No trust in Vane.

Security hardening

Defense in depth.

FAIL-CLOSED

All 17 authentication and verification functions fail closed. An unexpected error returns 401, never a false positive.

NONCE BINDING

Sender-constrained passports with per-request nonce binding prevent replay attacks even if a passport is intercepted.

CLOCK-SKEW

Strict nbf and exp enforcement with configurable clock-skew leeway across all five verifiers.

JCS / RFC 8785

RFC 8785 JSON Canonicalization Scheme ensures the exact bytes that were signed are the exact bytes that are verified. No serialization ambiguity.

RATE LIMITING

Sliding-window rate limiting on all issuance endpoints. Configurable per API key and per IP address.

mTLS

Mutual TLS authentication for enterprise deployments. Client certificates bound to company identity at the TLS layer.

Responsible disclosure

Found something?

We take security reports seriously. If you discover a vulnerability, please disclose it responsibly. We commit to acknowledging reports within 24 hours and providing a resolution timeline within 72 hours.

We do not currently offer a bug bounty program, but we recognize researchers who responsibly disclose vulnerabilities.

Compliance roadmap

Where we're headed.

Now
Security documentation available on request. Architecture review available for enterprise prospects.
Q4 2026
Third-party penetration test. Results summary published.
2027
SOC 2 Type II audit initiated.