Trust boundary
Managed hosts open outbound TLS connections. The host agent independently checks commands, services and file paths; the hub and AI client are treated as untrusted request sources.
PRIVATE BETA · EFFECTIVE 19 SEPTEMBER 2026
Security
NodeMender is built around outbound-only agents, deny-by-default host policy and tamper-evident operation evidence.
Identity and access
New devices use one-time enrollment, device-bound Ed25519 identity and short-lived sessions. Dashboard and MCP access enforce current organization membership and roles.
Release integrity
Installers verify signed manifests, artifact digests, SBOM and provenance, reject downgrades and retain rollback state. The serving hub has no release private key.
Availability
The production beta uses two failure domains and a streaming PostgreSQL standby. Database promotion remains guarded and manual until reliable fencing prevents split-brain operation.
Report a vulnerability
Email [email protected] or use GitHub Private Vulnerability Reporting from the repository security page. Never place credentials, host data or exploit details in a public issue.