Axon handles sensitive biometric and health data. Security is not a feature — it is a fundamental constraint. This document describes our supported versions, the disclosure process for vulnerabilities, and our security architecture.
| Version | Supported |
|---|---|
main (latest) |
✅ Active security support |
dev (pre-release) |
|
| All tagged releases | See release notes |
⚠️ Do NOT open a public GitHub Issue for security vulnerabilities. Doing so could expose users to risk before a fix is available.
- Open a GitHub Security Advisory (private, visible only to maintainers).
- Include as much detail as possible:
- A description of the vulnerability
- Steps to reproduce
- Potential impact (data exposure, privilege escalation, integrity bypass, etc.)
- Any proof-of-concept code (do not include real biometric data)
- You will receive an acknowledgment within 48 hours.
- We aim to provide a fix or mitigation within 14 days for critical issues, 30 days for medium/low.
- You will be credited in the security advisory and CHANGELOG unless you prefer to remain anonymous.
Axon's security model is designed around three non-negotiable principles:
- The SQLite database is encrypted at rest using AES-256 via SQLCipher.
- The encryption key is derived exclusively from the device's TPM (Windows) or Secure Enclave (iOS/Android) via the
IHardwareVaultinterface. - No key is ever stored in software, config files, or environment variables.
- The
MockHardwareVaultused in development must never be used in production builds.
- Every read and write operation on biometric data is intercepted by
AuditLoggingDecorator. - Audit records are written to an immutable
AuditLogtable in the same transaction. - Audit entries include: timestamp, operation type, record identifier, and actor context.
- Axon contains zero third-party telemetry, analytics, or crash-reporting SDKs.
- All outbound network I/O can be disabled with the Air-Gap toggle.
- The CI pipeline enforces a dependency audit to flag any new packages that introduce outbound HTTP calls.
| Constraint | Status |
|---|---|
MockHardwareVault bypasses TPM — for dev only |
|
| gRPC Sovereign Sync not yet implemented | 🚧 In progress — no sync surface yet |
| Mobile Secure Enclave integration pending | 🚧 In progress |
| Threat | Mitigation |
|---|---|
| Physical device compromise | AES-256 database encryption; key in TPM/Enclave |
| Data exfiltration via network | Air-gap mode; no outbound calls from Core |
| Malicious dependency | Dependency audit in CI; no auto-upgrade of transitive deps |
| Log/debug data leakage | PII Shield — biometric values masked in ToString() |
| Key extraction | Keys stored only in hardware vault, never in memory longer than needed |
| Supply chain attack | Pinned SDK version (global.json), no unreviewed dependencies |
These are hard requirements enforced during code review:
- All new
IRepositoryimplementations must useAuditLoggingDecoratorandEncryptionDecorator. - All
ToString()and logging methods on domain objects must maskValuefields. IHardwareVaultmust be used for all cryptographic key derivation — noRNGCryptoServiceProvideror static keys.- No package that makes outbound HTTP calls may be added to
Axon.Core. - AOT publish must succeed — no reflection-based security libraries.
Users have the ability to permanently destroy their data by deleting the hardware-backed key via the Sovereign Settings screen. This renders the encrypted database permanently unreadable without any recovery path. This is by design.
Security vulnerabilities in Axon represent a direct risk to user health privacy. We treat them with the highest priority.