Do not open a public GitHub issue for security vulnerabilities.

Email security reports to the project maintainers. You should receive a response within 48 hours. Confirmed issues receive a patch as soon as possible, coordinated with CVE publication if warranted.

GenID implements defense-in-depth across 7 layers. The table below summarizes the audited state of each control (last audit: 2026-07-29).

OWASP's flagship Top 10 was refreshed in 2025 (the 2021 list is now superseded). Every 2025 risk category is addressed by a concrete control in this repository — recruiters and senior engineers can verify each claim by following the file path.

Open items mapped to OWASP Top 10:2025:

• A07 — JWT jti replay protection not yet enforced (queue #4)
• A07 — JWT signing key not persisted across restarts (queue #5)
• A04 — HMAC default secret for CAEP webhooks (queue #6)
• A02 — Production gate to fail-fast on known default keys (queue #7)
• A10 — Panic-recovery HTTP middleware (queue #11)

The OWASP Top 10 for LLM/GenAI Applications is a separate, AI-specific list (2025 edition). GenID is built for the agentic era — its Non-Human Identity governance is a direct mitigation for LLM06 (Excessive Agency), the single biggest risk when LLM agents act on real systems. Mapping below is honest: ✅ controlled today, ⛔ low risk by design, ⚠️ partial / production slot.

The standout message for AI-security recruiters: GenID does not bolt AI onto a legacy IAM. Its NHI plane is purpose-built to neutralize LLM06 (Excessive Agency) — the OWASP LLM risk that Anthropic, OpenAI, and every agentic-AI company must solve to ship agents that act safely.

1. Rotate credentials — Remove POSTGRES_PASSWORD, NEO4J_AUTH, API_KEYS, MASTER_KEY from infrastructure/docker-compose.yml. Move to .env.
2. Fix redirect URI validation — Replace strings.HasPrefix with exact URL component match in backend/internal/oidc/handlers.go:544
3. Escape user input in HTML — Use html.EscapeString() or html/template in backend/internal/oidc/handlers.go:77,354

4. Implement JWT jti replay protection — Check jti against Redis blocklist in backend/internal/middleware/jwt_auth.go:132
5. Persist JWT signing key — Write key to file on first start, load on subsequent starts backend/internal/oidc/provider.go:37
6. Remove HMAC default secret — Return error if CAEP_HMAC_SECRET is not set backend/internal/activities/activities.go:832
7. Add production gate — Exit with fatal on startup if MASTER_KEY/VAULT_MASTER_KEY matches known default

8. Redis authentication — Set REDIS_PASSWORD in .env and configure Redis container with requirepass
9. ✅ DONE (2026-08) — All internal services in docker-compose.yml now bind to 127.0.0.1; only the Cloudflare Tunnel reaches the gateway.
10. Audit log response body sanitizer — Strip tokens from error response bodies before capture backend/internal/audit/audit.go:203
11. Add panic recovery HTTP middleware — Top-level recovery wrapper in backend/cmd/identity-service/main.go

1. Set VAULT_MASTER_KEY — 32+ character hex key generated with openssl rand -hex 32. The service does NOT start without it.
2. Set MASTER_KEY — enables WorkflowGuard for 12 sensitive mutation endpoints.
3. Set API_KEYS — comma-separated name:key values. Without these, auth is disabled entirely.
4. Disable DEV_LOGIN_ENABLED — set to false in production. This is a developer-test-only endpoint.
5. Set CORS_ORIGIN — your frontend domain. Never use *.
6. Set PRODUCTION=true — enables additional startup checks (key strength, disabled dev endpoints).
7. Rotate MASTER_KEY every 90 days — use the SetKeys() hot-reload over API.
8. Enable TLS — set TLS_CERT_FILE and TLS_KEY_FILE.
9. Bind database ports to 127.0.0.1 — do not expose PostgreSQL, Redis, or Neo4j to the network.

Check dependencies before every deploy:

# Go
go mod verify
go mod tidy

# Frontend
npm audit fix

# Secrets scan
gitleaks detect --verbose

# Go vulnerability check
govulncheck ./...

This project follows the principle of least privilege, defense in depth, and assume breach architecture.