For AI agents: the complete documentation index is available at https://payhon.github.io/AppKernia/en-US/llms.txt, the full documentation bundle is available at https://payhon.github.io/AppKernia/en-US/llms-full.txt, and this page is available as Markdown at https://payhon.github.io/AppKernia/en-US/concepts/security.md.
AppKernia

Security model

  • Never commit secrets, tokens, passwords, OTPs, MFA secrets, private keys, or real third-party credentials.
  • Never disable TLS verification; production Mobile APIs do not accept HTTP.
  • The server stores refresh-token hashes only; Mobile uses system secure storage and Admin uses a Secure HttpOnly cookie.
  • The server generates random object keys and re-checks tenant and reference authorization on download.
  • V1 does not fetch arbitrary remote URLs, reducing SSRF exposure.
  • Schedules invoke compile-time registered handlers, never Shell, SQL, or source code stored in the database.
  • Modules form a compile-time catalog; unknown binary upload or execution is not supported.
  • Audit and logs redact fields and never record Authorization, cookies, or presigned URLs.

Use GitHub Private Vulnerability Reporting or a Security Advisory. Never publish exploit details or real data in a public issue. See the security policy.