No secret values
The product model contains identifiers and lifecycle metadata only. Forms and APIs do not accept credential values.
Security by subtraction
Monitor the lifecycle, not the secret.
A credential monitor should not become a high-value credential vault by accident. KeyGuardRail’s primary control is collecting less.
Your systemsSecret valueremains in your provider or vault
KeyGuardRailOwner · provider · environment · datesenough context to prevent missed rotation
MVP controls
A narrow trust boundary, enforced in code.
Tenant-scoped access
Every inventory query derives its organization from the authenticated server session, never from a client-provided tenant ID.
Hardened sessions
Opaque, high-entropy tokens are stored as HMAC digests, delivered in HttpOnly Secure SameSite cookies, and expire after twelve hours.
Append-only evidence
Security-relevant activity is written as immutable audit events with the actor, organization, action, target, and request context.
Private data plane
PostgreSQL is reachable only on the internal container network. The application is exposed solely through TLS-terminating Nginx.
Least privilege by default
Future provider connections are read-only wherever possible, narrowly scoped, separately revocable, and encrypted outside the primary database.
Before provider integrations
Security gates, not marketing promises.
- 01Independent threat-model review and abuse-case tests
- 02Envelope encryption with a managed KMS for provider tokens
- 03Fine-grained integration scopes and revocation runbooks
- 04Backups, restore drills, alert delivery monitoring, and incident response
Start small