Security posture

Vrtmv is built for regulated environments. The security model follows from one principle: workload data stays on the customer host, and every off-host interaction is minimal and authenticated.

Data locality

Image contents, /etc, accounts, and keys are never transmitted. From a stable-channel build, the only data that leaves the host is package identifiers (for translation) and a one-way VM fingerprint (for metering). See Architecture.

The beta channel is the one exception, and it is opt-in. A beta build additionally reports diagnostics on every run — command, outcome, OS pair, timings, counts, and a redacted error message. It never reports image contents, configuration, host names, addresses, paths or package name lists. An account admin enrols the account explicitly, and that enrolment is the consent; a stable build cannot report diagnostics under any configuration, because the channel is fixed at compile time rather than read at run time. Run vrtmv diagnostics on any binary to see which channel it is and exactly what it sends. See The beta channel.

Transport

The client refuses to send its bearer token over cleartext http:// to a non-loopback host; the API base URL must be https://. A loopback development server is the only exception, plus an explicit opt-out for controlled testing.

Credentials

Tokens are stored client-side in an owner-only file and shown masked. Server-side they are held only as a SHA-256 hash; the plaintext is never persisted. Tokens can be disabled per token or per account.

Untrusted input

The client parses cold, potentially hostile disk images. Package-database reads are size-bounded to prevent memory exhaustion, image parsing is panic-contained so a malformed database is a clean error rather than a crash, and paths supplied by the API are confined to the mounted image root. Block-layer attach is always read-only, so analysis cannot modify the source. Disk mounting shells out to standard, audited system tools rather than reimplementing block-device handling.

Service integrity

The API parameterises every database query, authorises every non-public route against the authenticated account, and bounds request size, duration, and batch size. Metering is attributed per token and recorded to an auditable log.