Security
What is protected, and what is not.
Tarn is a self-hosted product, not a certified platform. The controls below are implemented and tested; the gaps below are real. Review them against your own risk model before exposing a deployment.
Controls in place
- +Structurally read-only infrastructure adapters; generated code is proposal-only.
- +Argon2id password hashing with rehashing of legacy hashes on sign-in.
- +Hashed session tokens in HttpOnly, SameSite cookies with idle and absolute expiry.
- +Owner, admin, member, and viewer roles with tenant-scoped queries and audit records.
- +CSRF protection, trusted-proxy rate limits, idempotency, and request-size caps.
- +Secret redaction before logs, evidence, audit records, or optional AI calls.
- +Encrypted, retrying background jobs and configurable audit retention.
- +CI gates for tests, coverage, static analysis, dependency audits, image builds, and manifests.
Honest gaps
- !No MFA, SSO, SAML, or SCIM.
- !No SOC 2, ISO 27001, or third-party penetration-test claim.
- !Rate limiting is per process; use an edge or shared limiter for multiple replicas.
- !Job encryption uses an operator-managed key, not KMS/HSM rotation.
- !No DNS pinning or network egress allow-list is enforced by the app.
Production always requires authentication. A deployment still needs its own monitoring, backup, key-management, and incident-response procedures.