Security Model

Aevrin analyzes untrusted source and configuration, so execution boundaries are part of the product—not an implementation detail.

Source scanners

The local CLI mounts source read-only into version-pinned scanner containers. Production scan workers invoke pinned native scanners as a non-root user with CPU, process, timeout, and platform memory limits. Scanner subprocesses receive a sanitized environment that excludes account, database, payment, and unrelated application secrets.

MCP inspection

Only public remote HTTPS endpoints may be contacted. DNS and redirects are validated against loopback, private, link-local, metadata, and credential-bearing destinations. Submitted stdio commands are never executed by the hosted service. If no safe entrypoint is discoverable, the tool-description stage is skipped and explained.

Credentials and stored data

API keys are stored hashed; plaintext is shown once. CLI and hook credentials are separate and revocable. Pasted configuration is redacted before persistence. Scanner stderr and error output are scrubbed before reaching logs, reports, or CLI upload records.

Trust statements

CLI findings are self-reported because the scan ran on the user's machine. The API recomputes the score from uploaded findings but does not independently rerun local source. Static results are evidence for their tested scope, not a runtime sandbox guarantee or cryptographic attestation.