Security and data

How dpndncY handles your data, for the security team reviewing it. Each statement was checked against the running product.

#Where your data lives

#Running without the internet

With DPNDNCY_AIRGAPPED=true the product makes no outbound calls and takes vulnerability data from an offline database you import (Running dpndncY without internet access (air-gapped)).

#Authentication

• Local accounts: passwords hashed with bcrypt. A minimum of 8 characters when an administrator sets one.
• Two-step verification: time-based one-time codes. A tenant owner can require it for every member, who can then only sign in to enrol.
• Single sign-on: OpenID Connect and SAML 2.0, built in. Single sign-on proves identity; a person must still be added to a tenant to get access.
• API tokens: for pipelines and agents. Bound to one user and one organisation, carrying that user's role. They can be capped in lifetime (API_TOKEN_MAX_DAYS), listed and revoked.
• Rate limiting on sign-in (20 attempts per 15 minutes per address) and on the API.
• Sessions are signed with a key that rotates automatically (Running dpndncY). Browser sessions end after 8 hours, after 30 minutes idle, and whenever the server restarts.

#Isolation between customers

Everything is scoped to an organisation (a tenant): projects, scans, findings, users, policy and settings. Queries are filtered by tenant, and a person sees another tenant's data only if they are a member of it. Within a tenant, an owner can limit which projects a member sees (Project access).

#Roles

#Encryption

#Audit log

Sign-ins, setting and policy changes, user and tenant changes, token and key rotation, and scans are recorded with who, what, when and from where. Entries are kept for 90 days by default; set AUDIT_LOG_RETENTION_DAYS for longer. Operators see the log under Settings, Activity, and it can be exported.

#The container

• Runs as a non-root user, with a read-only root filesystem (the only writable places are the data volume and a temporary folder).
• Contains no secrets or .env file: configuration arrives through environment variables.
• Listens on two internal ports behind a reverse proxy.
• Untrusted package and build steps are not run on the host. They run only in separate worker containers you approve, and not at all when none is configured.
• Standard security headers are set on responses (content security policy, no sniffing, frame restrictions, HSTS at the proxy).

The container acceptance test checks the non-root user, the read-only filesystem, the absence of a .env, sign-in, upload, persistence and failure behaviour on every build.

#Software supply chain

dpndncY scans software supply chains, so it is held to the same bar: its own dependencies are audited for high and critical issues on every change, and the image, the chart and the command line client are built in CI from tagged source.

#Your responsibilities