> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getpostern.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Security model
> The premise every other rule follows from, the three properties Postern holds by design, and what nobody outside the project has reviewed.
**Before you start**
* **Your credentials are encrypted. Your data is not.** The vault holds
provider tokens and passwords. The rows Postern syncs are ordinary Postgres
columns.
* **The Console port has no password.** Which computers can reach it is the
whole of its protection.
* **Nobody outside the project has audited this code.** There has been no
external security review and no penetration test.
This page carries the premise every other rule follows from, the three properties
Postern holds by design, and the honest account of what has not been reviewed.
Each subject below has its own page.
| Page | What it answers |
| ----------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- |
| [Which computers can reach Postern](/reference/ports) | The two ports, the `127.0.0.1:` prefix, what protects each route group, the push-ingest route, and reaching Postern from another network. |
| [The vault and the master key](/reference/vault) | What Postern encrypts, where the master key comes from, how to rotate it, and what `docker compose down -v` destroys. |
| [Provider sign-ins](/reference/provider-sign-ins) | The pinned redirect address, what each provider needs and why, and the three credentials that behave like passwords. |
| [Agent keys](/reference/agent-keys) | What a key is, the deadline it can carry, and the four operator verbs that end one. |
| [Why an agent was refused](/reference/refusals) | Which refusal you are looking at, on which surface, and what it means. |
| [Grants and sectors](/reference/grants-and-sectors) | The permission model: the six sectors, and what one grant covers. |
| [The audit log](/reference/audit-log) | The record of agent calls: what one row holds, and what gets no row at all. |
| [MCP tools](/reference/mcp-primitives) | The tools an agent can call, and what each one returns. |
## The trust boundary
Postern serves one person on one machine. It is not a shared service, and every
rule on every page above follows from that.
| | |
| --------------- | -------------------------------------------------------------------------------------------------------------------------------- |
| **Trusted** | You, and the machine Postern runs on. |
| **Not trusted** | The network that machine sits on. The other devices in the house. The pages your browser has open. Every agent that holds a key. |
Anyone with a login on that machine already holds the database, the vault key
file and your browser. Postern defends nothing against them.
Postern opens two ports, and it opens both to this computer only. Only this
computer can reach these addresses. Nothing on your Wi-Fi, and nothing on the
internet, can. The database gets no port at all.
[Which computers can reach Postern](/reference/ports) carries both ports, what
protects each route group, and the one line in `docker-compose.yml` the whole
claim rests on.
Postern is open source, so you do not have to take any of this on trust.
## What Postern enforces by shape
Three properties hold by design:
* **The resolved identity is the first argument** of every function that returns
data, and the sector check runs before any SQL. Postern scopes every read to the
user on that identity. No path reads without one.
* **A secret never lives in a row.** A credential row carries a pointer into the
vault and nothing more. A domain row carries no pointer at all.
* **An unknown sector fails closed.** Postern refuses a target whose first word is
not one of the six sectors. A typo therefore never maps onto a grant you did
give.
[SECURITY.md](https://github.com/getpostern/postern/blob/main/SECURITY.md) in the
repository carries the project's full list. It covers properties this page has not
verified line by line.
## The record
Postern writes every agent read and every action to the record. It records what
happened; it never stops anything, and no call waits for a line to land. That
makes the record the compensating control for everything a grant cannot express,
and it is the reason nothing on this page claims to prevent an agent from
misbehaving.
**The record covers what your agents did, not what you did to your agents.** Six
acts leave no row at all. They are: create a key, rotate one, edit its sectors or
its deadline, revoke it, delete it, and set a connection's sync window. Keep your
own note of those. [What does not get a row](/reference/audit-log#what-does-not-get-a-row)
lists them.
Postern redacts credential-shaped arguments before it stores them.
[What the arguments hold](/reference/audit-log#what-the-arguments-hold) names the
fields and the cap. [The audit log](/reference/audit-log) carries what a row
holds and what gets one. Nothing in the database stops a row being changed or
deleted, so the record's integrity rests on the application and on your own
Postgres roles —
[the honest limits](/reference/record-limits#nothing-enforces-immutability).
## What has not been reviewed
Nobody outside the project has audited this code. There has been no external
security review and no penetration test. The review in the repository's own
history is internal — the same people who wrote the code, who then read it again.
One known question sits inside that gap. The push-ingest secret is the only
comparison in Postern that takes the same time whether the value is right or
wrong. Postern hashes agent keys and OAuth-bridge tokens with SHA-256 and looks
the digest up in Postgres by equality, which does not have that property. The
database compares a digest of the presented value rather than the value itself.
**We do not know whether that difference is reachable across a network**, and the
project has published no analysis of it.
Postern is pre-1.0. The supported version is the latest release. Fixes go into the
next release, and older releases do not get them, so update to stay fixed.
To report something, use GitHub's private vulnerability reporting on
[the postern repository](https://github.com/getpostern/postern). It opens an
advisory only the maintainers can see. There is no security mailbox, and an
exploitable finding should not go in a public issue. Read the scope section of
[SECURITY.md](https://github.com/getpostern/postern/blob/main/SECURITY.md) first.
Two properties sit on its out-of-scope list on purpose. The admin routes carry no
per-request authentication when a caller reaches them from this computer, and
Postern does not encrypt the cached data at rest.
## What you have now
One line you can state flatly. Your credentials are encrypted and your data is
not, and both ports stay opened to this computer only until you decide otherwise.
Three standing costs come with that. The Console port's protection is its address,
so anything that widens which computers can reach it removes the protection
entirely. The vault key file is the whole secret, so your copy of it is the only
recovery path there will ever be. And nobody outside the project has reviewed any
of this.
## Next
the two ports, the `127.0.0.1:` prefix, and what protects each route group
what is encrypted, where the master key lives, and what destroys it