Security

AuthOS is security-sensitive infrastructure. The codebase includes several security-focused design choices, but safe operation still depends on how you deploy and manage it.

AuthOS is pre-1.0. No independent security assessment or general production-readiness guarantee has been published yet. Review the public project status, production-readiness roadmap, and repository security policy before evaluating a deployment.

Code and protocol choices

• Rust for the backend implementation
• Argon2 password hashing
• JWT signing support
• MFA, passkeys, and magic-link flows
• audit and security-event surfaces

Deployment expectations

You are responsible for:

• TLS and reverse-proxy configuration
• protecting database access
• managing secrets such as JWT keys and ENCRYPTION_KEY
• keeping your deployment updated

Reporting a vulnerability

Do not open a public issue for a security problem. Email info@authos.dev with the subject AuthOS security report so details can be handled privately first.