Security

Keyraft is designed with security in mind, but proper deployment practices are essential.

Built-in Protections

• Secrets encrypted at rest with AES-256-GCM
• Token-based authentication with RBAC and scoped access
• Namespace isolation prevents unauthorized cross-project access
• Version tracking maintains a full audit trail
• Audit logging records all API actions

Important Security Notes

DANGER

Follow these practices in production deployments.

• Always set a strong KEYRAFT_MASTER_KEY (32+ bytes)
• Store the root token securely (password manager, vault, etc.)
• Use role-based tokens for applications (principle of least privilege)
• Prefer RBAC roles over legacy scopes for new tokens
• Enable TLS when exposing to untrusted networks
• Rotate tokens regularly and revoke unused ones

Master Key

The master key encrypts all secrets. If lost, secrets cannot be recovered. If compromised, all secrets should be rotated.

export KEYRAFT_MASTER_KEY=$(openssl rand -base64 32)

Never commit the master key to source control or bake it into container images without a secrets manager.

TLS

Keyraft does not terminate TLS natively. Use a reverse proxy (nginx, Caddy, Traefik) for HTTPS in production:

Client ──HTTPS──► Reverse Proxy ──HTTP──► Keyraft :7200

Token Hygiene

Practice	Why
Short-lived service tokens	Limits blast radius if leaked
Scoped namespaces	Apps only see their own config
Revoke on decommission	Prevents stale access
Audit log review	Detect unauthorized access

Reporting Vulnerabilities

Report security vulnerabilities to xentixar@gmail.com.

License

Keyraft is licensed under Apache License 2.0.