Every design decision in Vane starts from a threat model. Here's exactly how we protect your agents.
Industry-standard elliptic curve signatures. Every passport and attestation is signed with Ed25519 — the same algorithm used by SSH, TLS 1.3, and Signal. 128-bit security level. Deterministic. Fast.
Envelope encryption for all sensitive credential material. AES-256-GCM provides both confidentiality and authenticity. Credentials are encrypted at rest in PostgreSQL with a separately-stored master key.
An append-only SHA-256 binary Merkle tree anchors every attestation. Any inclusion proof is verifiable offline with only the CA public key — O(log n) verification, no network call required.
Most identity systems require you to call our API to verify a credential. If our servers are down, your verification fails. If our database is compromised, your audit trail is worthless.
Vane passports verify offline. Given a passport, an inclusion proof, and our CA public key — all public information — any third party can independently verify any agent action. No network call. No trust in Vane.
All 17 authentication and verification functions fail closed. An unexpected error returns 401, never a false positive.
Sender-constrained passports with per-request nonce binding prevent replay attacks even if a passport is intercepted.
Strict nbf and exp enforcement with configurable clock-skew leeway across all five verifiers.
RFC 8785 JSON Canonicalization Scheme ensures the exact bytes that were signed are the exact bytes that are verified. No serialization ambiguity.
Sliding-window rate limiting on all issuance endpoints. Configurable per API key and per IP address.
Mutual TLS authentication for enterprise deployments. Client certificates bound to company identity at the TLS layer.
We take security reports seriously. If you discover a vulnerability, please disclose it responsibly. We commit to acknowledging reports within 24 hours and providing a resolution timeline within 72 hours.
We do not currently offer a bug bounty program, but we recognize researchers who responsibly disclose vulnerabilities.