Security
A security tool should be secure.
Cerberon holds the most sensitive list you have: what is wrong with your systems. Here is how we keep it safe, starting with not holding it at all.
Your data stays on your server
- Cerberon is installed on infrastructure you control. Source code, credentials, findings and reports are stored there, not with us.
- Rule-based code, secret and dependency scanning send nothing to any AI provider.
- Agent requests go only to the provider you configure, masked first when the privacy policy is on.
- Every outbound connection the instance makes is listed in the network and egress documentation.
Built to contain what it tests
- Each scan runs in its own worker with all Linux capabilities dropped, no privilege escalation, a read-only root file system and memory and CPU limits.
- Source code is mounted read-only into the scan that reads it.
- Loopback, link-local and cloud metadata addresses are refused as scan targets.
- Every scan of a host or web target requires an explicit authorisation confirmation.
Secrets and access
- Cloud, registry and AI credentials are encrypted with AES-256-GCM and released only to the scan that needs them.
- Sessions are held on the server and can be revoked. SSO through OIDC or SAML, and authenticator-app MFA for local accounts.
- Role-based permissions with custom roles, and API tokens limited to read or read and write, expiring within 365 days.
- An audit log of security-relevant actions, kept for 180 days by default and up to ten years.
Releases you can verify
- Every release and download is verified against Cerberon's signature before it is used.
- Updates are never pushed to your instance. An administrator applies them, and a snapshot is taken first so a failed update rolls back.
- SBOM and CBOM documents are signed with Ed25519, with the public key published on your instance.
- The licence service stores no IP address or user agent, and licence keys are kept only as a hash.
Found a vulnerability?
Email security@cerberon.dev. We acknowledge reports within three working days and do not take action against good-faith research. Read the Vulnerability Disclosure Policy.
See it on your own systems.
A 30-minute demo on your targets, or install it yourself and start scanning this afternoon.