How Stackurity protects your data

A list of every unpatched weakness in your estate is valuable to an attacker. Stackurity is designed so that list stays with you and the tool itself does not become a way in.

Your server, your data

• Self-hosted Stackurity runs on your own server, with no vendor account and no telemetry, and licences are verified offline. Besides the advisory feeds and the integrations you set up, the only automatic outbound request is an anonymous check for new releases on GitHub, which sends nothing about you and can be turned off.
• Every outbound connection is documented: the vulnerability and lifecycle feeds, and the integrations you configure.
• Secrets are referenced, never stored in plain text. Workspaces can store their own credentials encrypted with AES-256-GCM; values can be replaced but never read back.

Stackurity Cloud

• The service and its database run in India, in a DigitalOcean data centre in Bangalore. Each organisation is isolated from every other by row-level security in the database.
• Daily database backups are kept on the same server for 7 days. An off-site copy is encrypted with a key only we hold before it leaves the server, and is kept for 30 days.
• Payments are taken by Razorpay on its own payment page; we never see card details.
• When a trial or plan ends, the organisation becomes read-only, and its data is deleted after 30 days unless a plan is chosen. See the Privacy Policy for everything we keep and for how long.

Agents that only read

• The host agent runs as an unprivileged user, reads package databases and application directories, and changes nothing.
• Agents only connect out to your server; nothing needs inbound access to your machines.
• Enrollment codes are short-lived and limited-use; each host can be given a token that can report only for itself.
• Automatic fixing (Pro) is opt-in per host and per rule, needs an allowlist on the host itself, and stages every change with a canary, verification and halt on failure.

Nothing you scan is executed

• Lockfiles, manifests, SBOMs and images are parsed as data. Package managers, build scripts and repository hooks are never run.
• Git clones are shallow and hardened, with no hooks, submodules or LFS, and are deleted afterwards.
• Server-side requests made on behalf of a workspace cannot reach internal addresses such as cloud metadata services.

Sandboxed, signed stack packs

• Stack packs are WebAssembly modules with no network, no file system beyond the files they are given, a memory cap and a time limit.
• Each pack is signed; a server installs only packs from publishers it trusts, and re-checks the signature every time it loads one.
• A pack may report only the kinds of packages its manifest declares.

Workspaces kept apart by the database

When one installation serves several organisations, each workspace’s data is separated by PostgreSQL row-level security as well as by the application, so a query that forgot a filter still returns nothing from another workspace. Automated tests sign in to one workspace and try to read and change another’s data through the API.

Two-factor sign-in

Anyone can add a six-digit code from an authenticator app (TOTP) to their password, with ten one-time recovery codes for a lost phone. An organisation can require it of every member who signs in with a password. The authenticator key is stored encrypted, recovery codes only as hashes.

Signed releases

Release binaries and container images are signed with Sigstore and published with build provenance and an SBOM. Every change to the open-source core is checked with govulncheck, OSV-Scanner and CodeQL, and Stackurity scans its own dependencies. A release is not published while govulncheck finds a vulnerability the Go code can reach, npm audit finds a high or critical one in the web interface's dependencies, or the container image has a fixable high or critical vulnerability.

Reporting a vulnerability

Please report security issues privately through GitHub’s Report a vulnerability form, or by email to info@stackurity.dev. Please do not open a public issue.