Security
The public boundary is the Go API and the separately protected FastMCP gateway. The indexer, PostgreSQL, Redis, and MinIO/S3 belong on private networks.
Required controls
| Control | Implementation |
|---|---|
| Identity | SimpleJWT-compatible access tokens and PBKDF2-SHA256 password compatibility |
| Browser perimeter | Configured CORS and TLS reverse proxy |
| Abuse resistance | Redis-backed client rate limits plus request timeouts |
| Durable authority | PostgreSQL transactions and conditional updates |
| Object protection | Authorized MinIO/S3 streams; no raw credential exposure |
| Agent safety | JWT forwarding, path allowlist, and confirm=true for mutations |
| Secret protection | Environment/secret manager injection; redacted logs |
Never authorize an action only in the gateway. Never record passwords, OTPs, JWTs, provider keys, document content, or embeddings in logs. Re-run cross-user authorization tests after every new route or FastMCP mutation tool.
Last updated on