Authentication
Password plus TOTP on every sign-in. Offline recovery codes are one-time, issued after fresh MFA, and never stored in the browser session. Losing both factors requires supervised recovery.
Security
Controls that stay visible.
The lab prefers denied work over silent success. Authentication, authorization, intake, live providers, and fund moves are separate gates — not a single toggle.
Reauthentication
Privileged settings, recovery-code rotation, key export, sweeps, and similar actions demand a recent MFA verification window — not merely an old login cookie.
Sessions
Secure, HttpOnly, SameSite cookies with bounded lifetime. Role changes revoke the target user’s active sessions. Logout invalidates the server-side token.
Data protection
Encrypt, scope, and forget quickly.
- Artifacts are encrypted at rest after intake; retention is operator-controlled within policy bounds.
- Case permissions are explicit — read or write grants, removable without deleting audit history.
- Reports are sanitized and permission-scoped; they do not dump private keys.
- Exports reveal secrets once where designed; audit events record that an export happened, not the key material.
- Provider credentials are encrypted in owner configuration and never echoed to the UI.
Runtime gates
Production stays fail-closed.
| Gate | Protects | Typical closed behaviour |
|---|---|---|
| Recovery intake | Uploads and verification admission | Backup upload paused; dashboard remains available |
| Live providers | External explorer calls | Research falls back to recorded / simulated paths |
| Key export | Option A/B private key reveal | Export actions denied |
| Fund moves | Sweep, batch sweep, fee-bump broadcast | On-chain spend paths denied |
| Authorized V3 | Non-synthetic V3 decrypt workflows | Inspection / synthetic-only limits |
| GPU jobs | Gated OpenCL acceleration | CPU default; production GPU remains constrained |
Audit integrity
Security events append to a hash-chained audit log. Administrators and auditors can filter recent events and download signed checkpoints for independent storage — helping detect later truncation.
Transport & headers
Public HTTPS terminates on the lab origin. Responses set strict framing, referrer, and content-security policies. Marketing pages self-host fonts so CSP can stay tight (default-src 'self').
Operational isolation
Backend work runs over private Unix IPC with resource limits, not a public research API. Live provider egress is intentional and approved — not ambient internet access from every worker.