Security posture

Vrtmv is built for regulated environments. The security model follows from one principle: workload data stays on the customer host, and every off-host interaction is minimal and authenticated.

Data locality

Image contents, /etc, accounts, and keys are never transmitted. The only data that leaves the host is package identifiers (for translation), a one-way VM fingerprint (for metering) and, with a usage event, a one-way host hint that counts the hosts sharing a fingerprint. See Architecture.

No current build reports diagnostics. Until 2 October 2026 there was an opt-in beta channel whose builds also reported diagnostics on every run. The channel is retired, the reporting code was removed from the engine, and 2.2.0 is the first release built without it. Stable builds never sent these reports. The vrtmv diagnostics command, which printed a build's channel, was removed at the same time. What happens to reports that beta builds already sent, and what a beta build that is still installed does, is on The beta channel (retired).

Transport

The client refuses to send its bearer token over cleartext http:// to a non-loopback host; the API base URL must be https://. A loopback development server is the only exception, plus an explicit opt-out for controlled testing.

Credentials

Tokens are stored client-side in an owner-only file and shown masked. Server-side they are held only as a SHA-256 hash; the plaintext is never persisted. Tokens can be disabled per token or per account.

Untrusted input

The client parses cold, potentially hostile disk images. Package-database reads are size-bounded to prevent memory exhaustion, image parsing is panic-contained so a malformed database is a clean error rather than a crash, and paths supplied by the API are confined to the mounted image root. Block-layer attach is always read-only, so analysis cannot modify the source. Disk mounting shells out to standard, audited system tools rather than reimplementing block-device handling.

Service integrity

The API parameterises every database query, authorises every non-public route against the authenticated account, and bounds request size, duration, and batch size. Metering is attributed per token and recorded to an auditable log.