[{"data":1,"prerenderedAt":1556},["ShallowReactive",2],{"docs-nav":3,"doc-\u002Fdocs\u002Fsecurity":79,"content-query-VLvd9QLB67":908},[4,10,15,19,23,28,34,38,43,47,52,57,61,66,70,74],{"_path":5,"title":6,"description":7,"order":8,"category":9},"\u002Fdocs\u002Fapi-reference","API Reference","Overview of the Vaultaris REST API — endpoints, authentication, response conventions, and rate limiting.",1,"Reference",{"_path":11,"title":12,"description":13,"order":14,"category":9},"\u002Fdocs\u002Farchitecture","Architecture","System design overview — components, request lifecycle, background workers, and data flow in Vaultaris.",4,{"_path":16,"title":17,"description":18,"order":8,"category":17},"\u002Fdocs\u002Fconcepts","Core Concepts","Understand the building blocks of Vaultaris — tenants, users, roles, groups, applications, sessions, and the security primitives that connect them.",{"_path":20,"title":21,"description":22,"order":8,"category":21},"\u002Fdocs\u002Fconfiguration","Configuration","Complete reference for all Vaultaris environment variables.",{"_path":24,"title":25,"description":26,"order":8,"category":27},"\u002Fdocs\u002Fdeployment","Deployment Guide","Deploy Vaultaris to production using Docker Compose, bare metal, or a managed container platform.","Deployment",{"_path":29,"title":30,"description":31,"order":32,"category":33},"\u002Fdocs\u002Finstallation","Installation","Install Vaultaris using Docker, a pre-built binary, or by compiling from source.",3,"Getting Started",{"_path":35,"title":36,"description":37,"order":8,"category":33},"\u002Fdocs\u002Fintroduction","Introduction","Vaultaris is an open-source, enterprise-grade Identity and Access Management platform written in Rust — a self-hostable alternative to Keycloak and Auth0.",{"_path":39,"title":40,"description":41,"order":42,"category":27},"\u002Fdocs\u002Fkubernetes","Kubernetes","Deploy Vaultaris on Kubernetes using the official Helm chart or plain manifests.",2,{"_path":44,"title":45,"description":46,"order":42,"category":17},"\u002Fdocs\u002Fmulti-tenancy","Multi-Tenancy","How Vaultaris isolates organizations, supports SaaS use cases, and manages license-driven resource freezing.",{"_path":48,"title":49,"description":50,"order":8,"category":51},"\u002Fdocs\u002Foauth-oidc","OAuth 2.0 & OpenID Connect","How to integrate Vaultaris as an authorization server — authorization code, client credentials, password flows, DPoP sender-constrained tokens, and hosted login.","Authentication & Authorization",{"_path":53,"title":54,"description":55,"order":8,"category":56},"\u002Fdocs\u002Fplugins","Plugin Development","Extend Vaultaris with type-safe native Rust plugins.","Plugins",{"_path":58,"title":59,"description":60,"order":42,"category":33},"\u002Fdocs\u002Fquickstart","Quickstart","Run Vaultaris locally in under five minutes using Docker Compose.",{"_path":62,"title":63,"description":64,"order":42,"category":65},"\u002Fdocs\u002Fsdk-nodejs","Node.js SDK","Use the vaultaris-sdk package to integrate Vaultaris into your Node.js or TypeScript applications. Includes transparent DPoP support.","SDKs",{"_path":67,"title":68,"description":69,"order":8,"category":65},"\u002Fdocs\u002Fsdk-rust","Rust SDK","Use the vaultaris-sdk crate to interact with Vaultaris from your Rust applications. Includes transparent DPoP support.",{"_path":71,"title":72,"description":73,"order":32,"category":9},"\u002Fdocs\u002Fsecurity","Security","Security architecture, cryptographic choices, and hardening recommendations for Vaultaris.",{"_path":75,"title":76,"description":77,"order":78,"category":51},"\u002Fdocs\u002Fwebauthn","WebAuthn \u002F Passkeys \u002F FIDO2","Complete guide to integrating WebAuthn passwordless authentication and passkeys with Vaultaris.",5,{"_path":71,"_dir":80,"_draft":81,"_partial":81,"_locale":82,"title":72,"description":73,"order":32,"category":9,"body":83,"_type":902,"_id":903,"_source":904,"_file":905,"_stem":906,"_extension":907},"docs",false,"",{"type":84,"children":85,"toc":885},"root",[86,95,286,292,298,303,386,392,397,417,422,456,462,475,481,486,492,513,518,524,545,551,587,593,598,604,609,615,775,781,786,809,822,828,833,838,847,853,866,872],{"type":87,"tag":88,"props":89,"children":91},"element","h2",{"id":90},"cryptography",[92],{"type":93,"value":94},"text","Cryptography",{"type":87,"tag":96,"props":97,"children":98},"table",{},[99,118],{"type":87,"tag":100,"props":101,"children":102},"thead",{},[103],{"type":87,"tag":104,"props":105,"children":106},"tr",{},[107,113],{"type":87,"tag":108,"props":109,"children":110},"th",{},[111],{"type":93,"value":112},"Purpose",{"type":87,"tag":108,"props":114,"children":115},{},[116],{"type":93,"value":117},"Algorithm",{"type":87,"tag":119,"props":120,"children":121},"tbody",{},[122,136,149,162,184,213,226,239,252,265],{"type":87,"tag":104,"props":123,"children":124},{},[125,131],{"type":87,"tag":126,"props":127,"children":128},"td",{},[129],{"type":93,"value":130},"Password hashing",{"type":87,"tag":126,"props":132,"children":133},{},[134],{"type":93,"value":135},"Argon2id (memory-hard, OWASP-recommended parameters)",{"type":87,"tag":104,"props":137,"children":138},{},[139,144],{"type":87,"tag":126,"props":140,"children":141},{},[142],{"type":93,"value":143},"OAuth token signing",{"type":87,"tag":126,"props":145,"children":146},{},[147],{"type":93,"value":148},"Rotating ed25519 \u002F ECDSA P-256 keys (JWK set)",{"type":87,"tag":104,"props":150,"children":151},{},[152,157],{"type":87,"tag":126,"props":153,"children":154},{},[155],{"type":93,"value":156},"Internal token signing (MFA, setup)",{"type":87,"tag":126,"props":158,"children":159},{},[160],{"type":93,"value":161},"HMAC-SHA256 (HS256)",{"type":87,"tag":104,"props":163,"children":164},{},[165,170],{"type":87,"tag":126,"props":166,"children":167},{},[168],{"type":93,"value":169},"Sensitive data at rest (TOTP secrets)",{"type":87,"tag":126,"props":171,"children":172},{},[173,175,182],{"type":93,"value":174},"AES-256-GCM via ",{"type":87,"tag":176,"props":177,"children":179},"code",{"className":178},[],[180],{"type":93,"value":181},"vaultaris-crypto",{"type":93,"value":183}," crate",{"type":87,"tag":104,"props":185,"children":186},{},[187,192],{"type":87,"tag":126,"props":188,"children":189},{},[190],{"type":93,"value":191},"Token generation",{"type":87,"tag":126,"props":193,"children":194},{},[195,197,203,205,211],{"type":93,"value":196},"CSPRNG via OS (",{"type":87,"tag":176,"props":198,"children":200},{"className":199},[],[201],{"type":93,"value":202},"rand",{"type":93,"value":204}," + ",{"type":87,"tag":176,"props":206,"children":208},{"className":207},[],[209],{"type":93,"value":210},"getrandom",{"type":93,"value":212},")",{"type":87,"tag":104,"props":214,"children":215},{},[216,221],{"type":87,"tag":126,"props":217,"children":218},{},[219],{"type":93,"value":220},"PKCE challenge",{"type":87,"tag":126,"props":222,"children":223},{},[224],{"type":93,"value":225},"SHA-256 + base64url",{"type":87,"tag":104,"props":227,"children":228},{},[229,234],{"type":87,"tag":126,"props":230,"children":231},{},[232],{"type":93,"value":233},"DPoP proof verification",{"type":87,"tag":126,"props":235,"children":236},{},[237],{"type":93,"value":238},"ed25519 \u002F P-256 ECDSA — RFC 9449",{"type":87,"tag":104,"props":240,"children":241},{},[242,247],{"type":87,"tag":126,"props":243,"children":244},{},[245],{"type":93,"value":246},"WebAuthn credential signatures",{"type":87,"tag":126,"props":248,"children":249},{},[250],{"type":93,"value":251},"ES256 (ECDSA P-256 + SHA-256), RS256 fallback",{"type":87,"tag":104,"props":253,"children":254},{},[255,260],{"type":87,"tag":126,"props":256,"children":257},{},[258],{"type":93,"value":259},"WebAuthn challenge binding",{"type":87,"tag":126,"props":261,"children":262},{},[263],{"type":93,"value":264},"SHA-256 of clientDataJSON",{"type":87,"tag":104,"props":266,"children":267},{},[268,273],{"type":87,"tag":126,"props":269,"children":270},{},[271],{"type":93,"value":272},"Billing shadow service token",{"type":87,"tag":126,"props":274,"children":275},{},[276,278,284],{"type":93,"value":277},"Constant-time comparison (",{"type":87,"tag":176,"props":279,"children":281},{"className":280},[],[282],{"type":93,"value":283},"subtle",{"type":93,"value":285}," crate)",{"type":87,"tag":88,"props":287,"children":289},{"id":288},"dpop-sender-constrained-tokens",[290],{"type":93,"value":291},"DPoP — Sender-Constrained Tokens",{"type":87,"tag":293,"props":294,"children":295},"p",{},[296],{"type":93,"value":297},"DPoP (RFC 9449) prevents token replay attacks by cryptographically binding access and refresh tokens to the client's key pair. A stolen token cannot be used by an attacker who doesn't possess the private key.",{"type":87,"tag":293,"props":299,"children":300},{},[301],{"type":93,"value":302},"Vaultaris verifies:",{"type":87,"tag":304,"props":305,"children":306},"ul",{},[307,329,349,361,373],{"type":87,"tag":308,"props":309,"children":310},"li",{},[311,313,319,321,327],{"type":93,"value":312},"The ",{"type":87,"tag":176,"props":314,"children":316},{"className":315},[],[317],{"type":93,"value":318},"DPoP",{"type":93,"value":320}," header JWT is signed by the key in the ",{"type":87,"tag":176,"props":322,"children":324},{"className":323},[],[325],{"type":93,"value":326},"jwk",{"type":93,"value":328}," claim",{"type":87,"tag":308,"props":330,"children":331},{},[332,333,339,341,347],{"type":93,"value":312},{"type":87,"tag":176,"props":334,"children":336},{"className":335},[],[337],{"type":93,"value":338},"htm",{"type":93,"value":340},"\u002F",{"type":87,"tag":176,"props":342,"children":344},{"className":343},[],[345],{"type":93,"value":346},"htu",{"type":93,"value":348}," claims match the actual request method and URL",{"type":87,"tag":308,"props":350,"children":351},{},[352,353,359],{"type":93,"value":312},{"type":87,"tag":176,"props":354,"children":356},{"className":355},[],[357],{"type":93,"value":358},"iat",{"type":93,"value":360}," claim is within the acceptable clock skew window",{"type":87,"tag":308,"props":362,"children":363},{},[364,365,371],{"type":93,"value":312},{"type":87,"tag":176,"props":366,"children":368},{"className":367},[],[369],{"type":93,"value":370},"jti",{"type":93,"value":372}," is unique (replay prevention)",{"type":87,"tag":308,"props":374,"children":375},{},[376,378,384],{"type":93,"value":377},"The token's ",{"type":87,"tag":176,"props":379,"children":381},{"className":380},[],[382],{"type":93,"value":383},"cnf.jkt",{"type":93,"value":385}," thumbprint matches the proof's public key",{"type":87,"tag":88,"props":387,"children":389},{"id":388},"webauthn-passkeys",[390],{"type":93,"value":391},"WebAuthn \u002F Passkeys",{"type":87,"tag":293,"props":393,"children":394},{},[395],{"type":93,"value":396},"W3C WebAuthn Level 2 server-side verification (no external library). Covers: CBOR attestation object parsing, clientDataJSON verification, authenticatorData parsing, COSE public key extraction, sign counter validation (clone detection), challenge binding.",{"type":87,"tag":293,"props":398,"children":399},{},[400,402,408,410,415],{"type":93,"value":401},"rpId and expected origin are derived from ",{"type":87,"tag":176,"props":403,"children":405},{"className":404},[],[406],{"type":93,"value":407},"EXTERNAL_URL",{"type":93,"value":409},". Changing ",{"type":87,"tag":176,"props":411,"children":413},{"className":412},[],[414],{"type":93,"value":407},{"type":93,"value":416}," invalidates all stored passkey credentials.",{"type":87,"tag":293,"props":418,"children":419},{},[420],{"type":93,"value":421},"Security properties:",{"type":87,"tag":304,"props":423,"children":424},{},[425,430,443],{"type":87,"tag":308,"props":426,"children":427},{},[428],{"type":93,"value":429},"Challenges expire after 5 minutes, single-use",{"type":87,"tag":308,"props":431,"children":432},{},[433,435,441],{"type":93,"value":434},"Sign counter regression → ",{"type":87,"tag":176,"props":436,"children":438},{"className":437},[],[439],{"type":93,"value":440},"400",{"type":93,"value":442}," response (indicates potentially cloned authenticator)",{"type":87,"tag":308,"props":444,"children":445},{},[446,448,454],{"type":93,"value":447},"Unique ",{"type":87,"tag":176,"props":449,"children":451},{"className":450},[],[452],{"type":93,"value":453},"(tenant_id, credential_id_base64)",{"type":93,"value":455}," constraint per tenant",{"type":87,"tag":88,"props":457,"children":459},{"id":458},"passwords",[460],{"type":93,"value":461},"Passwords",{"type":87,"tag":293,"props":463,"children":464},{},[465,467,473],{"type":93,"value":466},"Argon2id via the ",{"type":87,"tag":176,"props":468,"children":470},{"className":469},[],[471],{"type":93,"value":472},"argon2",{"type":93,"value":474}," crate. Constant-time comparison. Password reset tokens: 32 bytes → 64 hex chars, 24-hour TTL, single-use. Password policy enforcement: minimum length, complexity, history, max age, and lockout threshold are configurable per tenant.",{"type":87,"tag":88,"props":476,"children":478},{"id":477},"sessions",[479],{"type":93,"value":480},"Sessions",{"type":87,"tag":293,"props":482,"children":483},{},[484],{"type":93,"value":485},"Sessions stored in PostgreSQL — not stateless JWTs. Instantly revocable server-side. Tied to IP and user-agent. Global sessions validate the requesting domain against a per-session allowlist with wildcard matching.",{"type":87,"tag":88,"props":487,"children":489},{"id":488},"device-registry",[490],{"type":93,"value":491},"Device Registry",{"type":87,"tag":293,"props":493,"children":494},{},[495,497,503,505,511],{"type":93,"value":496},"Every login registers or updates a device record derived from the ",{"type":87,"tag":176,"props":498,"children":500},{"className":499},[],[501],{"type":93,"value":502},"User-Agent",{"type":93,"value":504},". New devices trigger an email alert to the user and fire the ",{"type":87,"tag":176,"props":506,"children":508},{"className":507},[],[509],{"type":93,"value":510},"NEW_DEVICE_REGISTERED",{"type":93,"value":512}," plugin hook, enabling security notifications and anomaly detection.",{"type":87,"tag":293,"props":514,"children":515},{},[516],{"type":93,"value":517},"Admins and users can trust or revoke individual devices from the dashboard.",{"type":87,"tag":88,"props":519,"children":521},{"id":520},"rate-limiting",[522],{"type":93,"value":523},"Rate Limiting",{"type":87,"tag":293,"props":525,"children":526},{},[527,529,535,537,543],{"type":93,"value":528},"IP-level, evaluated before business logic. Default: 120 requests \u002F 60-second window. Distributed via Redis sliding-window algorithm (Lua script). Falls back to in-memory fixed-window when Redis is unavailable. Returns ",{"type":87,"tag":176,"props":530,"children":532},{"className":531},[],[533],{"type":93,"value":534},"429 Too Many Requests",{"type":93,"value":536}," with ",{"type":87,"tag":176,"props":538,"children":540},{"className":539},[],[541],{"type":93,"value":542},"Retry-After",{"type":93,"value":544},".",{"type":87,"tag":88,"props":546,"children":548},{"id":547},"tenant-isolation",[549],{"type":93,"value":550},"Tenant Isolation",{"type":87,"tag":293,"props":552,"children":553},{},[554,556,562,564,570,572,577,579,585],{"type":93,"value":555},"All queries are scoped by ",{"type":87,"tag":176,"props":557,"children":559},{"className":558},[],[560],{"type":93,"value":561},"tenant_id",{"type":93,"value":563}," at the middleware layer. ",{"type":87,"tag":176,"props":565,"children":567},{"className":566},[],[568],{"type":93,"value":569},"AuthenticatedUser",{"type":93,"value":571}," extractor enforces the ",{"type":87,"tag":176,"props":573,"children":575},{"className":574},[],[576],{"type":93,"value":561},{"type":93,"value":578}," claim in the Bearer token matches the route's ",{"type":87,"tag":176,"props":580,"children":582},{"className":581},[],[583],{"type":93,"value":584},"{tenant_id}",{"type":93,"value":586}," path parameter. Cross-tenant access is impossible except from the master tenant.",{"type":87,"tag":88,"props":588,"children":590},{"id":589},"email-enumeration-prevention",[591],{"type":93,"value":592},"Email Enumeration Prevention",{"type":87,"tag":293,"props":594,"children":595},{},[596],{"type":93,"value":597},"Password reset always returns HTTP 200 regardless of whether the email exists in the system. The response body is identical in both cases.",{"type":87,"tag":88,"props":599,"children":601},{"id":600},"audit-trail",[602],{"type":93,"value":603},"Audit Trail",{"type":87,"tag":293,"props":605,"children":606},{},[607],{"type":93,"value":608},"Every auth event, token issuance, role change, freeze\u002Funfreeze action, and admin operation produces an append-only audit record with actor, action, target resource, timestamp, IP, and user-agent.",{"type":87,"tag":88,"props":610,"children":612},{"id":611},"owasp-top-10",[613],{"type":93,"value":614},"OWASP Top 10",{"type":87,"tag":96,"props":616,"children":617},{},[618,634],{"type":87,"tag":100,"props":619,"children":620},{},[621],{"type":87,"tag":104,"props":622,"children":623},{},[624,629],{"type":87,"tag":108,"props":625,"children":626},{},[627],{"type":93,"value":628},"Risk",{"type":87,"tag":108,"props":630,"children":631},{},[632],{"type":93,"value":633},"Mitigation",{"type":87,"tag":119,"props":635,"children":636},{},[637,650,663,676,689,702,723,736,749,762],{"type":87,"tag":104,"props":638,"children":639},{},[640,645],{"type":87,"tag":126,"props":641,"children":642},{},[643],{"type":93,"value":644},"A01 Broken Access Control",{"type":87,"tag":126,"props":646,"children":647},{},[648],{"type":93,"value":649},"Tenant-scoped DB queries + AuthenticatedUser middleware",{"type":87,"tag":104,"props":651,"children":652},{},[653,658],{"type":87,"tag":126,"props":654,"children":655},{},[656],{"type":93,"value":657},"A02 Cryptographic Failures",{"type":87,"tag":126,"props":659,"children":660},{},[661],{"type":93,"value":662},"Argon2id, AES-GCM, CSPRNG, DPoP sender-binding",{"type":87,"tag":104,"props":664,"children":665},{},[666,671],{"type":87,"tag":126,"props":667,"children":668},{},[669],{"type":93,"value":670},"A03 Injection",{"type":87,"tag":126,"props":672,"children":673},{},[674],{"type":93,"value":675},"SQLx parameterized queries only — no string interpolation",{"type":87,"tag":104,"props":677,"children":678},{},[679,684],{"type":87,"tag":126,"props":680,"children":681},{},[682],{"type":93,"value":683},"A04 Insecure Design",{"type":87,"tag":126,"props":685,"children":686},{},[687],{"type":93,"value":688},"OAuth 2.0 + PKCE; email enumeration prevention; DPoP",{"type":87,"tag":104,"props":690,"children":691},{},[692,697],{"type":87,"tag":126,"props":693,"children":694},{},[695],{"type":93,"value":696},"A05 Security Misconfiguration",{"type":87,"tag":126,"props":698,"children":699},{},[700],{"type":93,"value":701},"Sane defaults; production checklist in docs",{"type":87,"tag":104,"props":703,"children":704},{},[705,710],{"type":87,"tag":126,"props":706,"children":707},{},[708],{"type":93,"value":709},"A06 Vulnerable Components",{"type":87,"tag":126,"props":711,"children":712},{},[713,715,721],{"type":93,"value":714},"Pure Rust audited crates; ",{"type":87,"tag":176,"props":716,"children":718},{"className":717},[],[719],{"type":93,"value":720},"cargo audit",{"type":93,"value":722}," in CI",{"type":87,"tag":104,"props":724,"children":725},{},[726,731],{"type":87,"tag":126,"props":727,"children":728},{},[729],{"type":93,"value":730},"A07 Auth Failures",{"type":87,"tag":126,"props":732,"children":733},{},[734],{"type":93,"value":735},"Argon2 + token expiry + session revocation + lockout",{"type":87,"tag":104,"props":737,"children":738},{},[739,744],{"type":87,"tag":126,"props":740,"children":741},{},[742],{"type":93,"value":743},"A08 Software Integrity",{"type":87,"tag":126,"props":745,"children":746},{},[747],{"type":93,"value":748},"Deterministic builds; release binary SHA-256 checksums",{"type":87,"tag":104,"props":750,"children":751},{},[752,757],{"type":87,"tag":126,"props":753,"children":754},{},[755],{"type":93,"value":756},"A09 Logging & Monitoring",{"type":87,"tag":126,"props":758,"children":759},{},[760],{"type":93,"value":761},"Structured tracing + append-only audit log",{"type":87,"tag":104,"props":763,"children":764},{},[765,770],{"type":87,"tag":126,"props":766,"children":767},{},[768],{"type":93,"value":769},"A10 SSRF",{"type":87,"tag":126,"props":771,"children":772},{},[773],{"type":93,"value":774},"No user-controlled URL fetching in core paths",{"type":87,"tag":88,"props":776,"children":778},{"id":777},"secrets-management",[779],{"type":93,"value":780},"Secrets Management",{"type":87,"tag":293,"props":782,"children":783},{},[784],{"type":93,"value":785},"Never commit secrets to git or embed them in Docker images or Kubernetes ConfigMaps. Use a dedicated secrets manager:",{"type":87,"tag":304,"props":787,"children":788},{},[789,794,799,804],{"type":87,"tag":308,"props":790,"children":791},{},[792],{"type":93,"value":793},"AWS Secrets Manager \u002F Parameter Store",{"type":87,"tag":308,"props":795,"children":796},{},[797],{"type":93,"value":798},"HashiCorp Vault",{"type":87,"tag":308,"props":800,"children":801},{},[802],{"type":93,"value":803},"1Password Secrets Automation",{"type":87,"tag":308,"props":805,"children":806},{},[807],{"type":93,"value":808},"Doppler",{"type":87,"tag":293,"props":810,"children":811},{},[812,814,820],{"type":93,"value":813},"Kubernetes: inject secrets as environment variables from ",{"type":87,"tag":176,"props":815,"children":817},{"className":816},[],[818],{"type":93,"value":819},"kind: Secret",{"type":93,"value":821}," objects, not ConfigMaps.",{"type":87,"tag":88,"props":823,"children":825},{"id":824},"tls",[826],{"type":93,"value":827},"TLS",{"type":87,"tag":293,"props":829,"children":830},{},[831],{"type":93,"value":832},"Terminate TLS at the edge (nginx, Caddy, cloud load balancer). Vaultaris listens on plain HTTP. Never expose port 8080 to the internet directly. Minimum TLS 1.2; prefer TLS 1.3.",{"type":87,"tag":293,"props":834,"children":835},{},[836],{"type":93,"value":837},"Caddy example (auto Let's Encrypt):",{"type":87,"tag":839,"props":840,"children":842},"pre",{"code":841},"auth.example.com {\n  reverse_proxy localhost:8080\n}\n",[843],{"type":87,"tag":176,"props":844,"children":845},{"__ignoreMap":82},[846],{"type":93,"value":841},{"type":87,"tag":88,"props":848,"children":850},{"id":849},"license-enforcement-freeze-security",[851],{"type":93,"value":852},"License Enforcement & Freeze Security",{"type":87,"tag":293,"props":854,"children":855},{},[856,858,864],{"type":93,"value":857},"The freeze system ensures that Vaultaris cannot be used to exceed purchased resource limits. Freeze operations are audited, and the ",{"type":87,"tag":176,"props":859,"children":861},{"className":860},[],[862],{"type":93,"value":863},"FreezeReason",{"type":93,"value":865}," enum distinguishes automatic (license-driven) freezes from manual admin freezes. Manual freezes are never automatically reversed on upgrade — they require explicit admin action.",{"type":87,"tag":88,"props":867,"children":869},{"id":868},"responsible-disclosure",[870],{"type":93,"value":871},"Responsible Disclosure",{"type":87,"tag":293,"props":873,"children":874},{},[875,877,883],{"type":93,"value":876},"GitHub Security Advisories or ",{"type":87,"tag":176,"props":878,"children":880},{"className":879},[],[881],{"type":93,"value":882},"security@vaultaris.net",{"type":93,"value":884},". 90-day coordinated disclosure policy.",{"title":82,"searchDepth":32,"depth":32,"links":886},[887,888,889,890,891,892,893,894,895,896,897,898,899,900,901],{"id":90,"depth":42,"text":94},{"id":288,"depth":42,"text":291},{"id":388,"depth":42,"text":391},{"id":458,"depth":42,"text":461},{"id":477,"depth":42,"text":480},{"id":488,"depth":42,"text":491},{"id":520,"depth":42,"text":523},{"id":547,"depth":42,"text":550},{"id":589,"depth":42,"text":592},{"id":600,"depth":42,"text":603},{"id":611,"depth":42,"text":614},{"id":777,"depth":42,"text":780},{"id":824,"depth":42,"text":827},{"id":849,"depth":42,"text":852},{"id":868,"depth":42,"text":871},"markdown","content:docs:security.md","content","docs\u002Fsecurity.md","docs\u002Fsecurity","md",{"_path":71,"_dir":80,"_draft":81,"_partial":81,"_locale":82,"title":72,"description":73,"order":32,"category":9,"body":909,"_type":902,"_id":903,"_source":904,"_file":905,"_stem":906,"_extension":907},{"type":84,"children":910,"toc":1539},[911,915,1069,1073,1077,1081,1146,1150,1154,1170,1174,1201,1205,1215,1219,1223,1227,1243,1247,1251,1267,1271,1299,1303,1307,1311,1315,1319,1455,1459,1463,1482,1492,1496,1500,1504,1511,1515,1525,1529],{"type":87,"tag":88,"props":912,"children":913},{"id":90},[914],{"type":93,"value":94},{"type":87,"tag":96,"props":916,"children":917},{},[918,932],{"type":87,"tag":100,"props":919,"children":920},{},[921],{"type":87,"tag":104,"props":922,"children":923},{},[924,928],{"type":87,"tag":108,"props":925,"children":926},{},[927],{"type":93,"value":112},{"type":87,"tag":108,"props":929,"children":930},{},[931],{"type":93,"value":117},{"type":87,"tag":119,"props":933,"children":934},{},[935,946,957,968,985,1008,1019,1030,1041,1052],{"type":87,"tag":104,"props":936,"children":937},{},[938,942],{"type":87,"tag":126,"props":939,"children":940},{},[941],{"type":93,"value":130},{"type":87,"tag":126,"props":943,"children":944},{},[945],{"type":93,"value":135},{"type":87,"tag":104,"props":947,"children":948},{},[949,953],{"type":87,"tag":126,"props":950,"children":951},{},[952],{"type":93,"value":143},{"type":87,"tag":126,"props":954,"children":955},{},[956],{"type":93,"value":148},{"type":87,"tag":104,"props":958,"children":959},{},[960,964],{"type":87,"tag":126,"props":961,"children":962},{},[963],{"type":93,"value":156},{"type":87,"tag":126,"props":965,"children":966},{},[967],{"type":93,"value":161},{"type":87,"tag":104,"props":969,"children":970},{},[971,975],{"type":87,"tag":126,"props":972,"children":973},{},[974],{"type":93,"value":169},{"type":87,"tag":126,"props":976,"children":977},{},[978,979,984],{"type":93,"value":174},{"type":87,"tag":176,"props":980,"children":982},{"className":981},[],[983],{"type":93,"value":181},{"type":93,"value":183},{"type":87,"tag":104,"props":986,"children":987},{},[988,992],{"type":87,"tag":126,"props":989,"children":990},{},[991],{"type":93,"value":191},{"type":87,"tag":126,"props":993,"children":994},{},[995,996,1001,1002,1007],{"type":93,"value":196},{"type":87,"tag":176,"props":997,"children":999},{"className":998},[],[1000],{"type":93,"value":202},{"type":93,"value":204},{"type":87,"tag":176,"props":1003,"children":1005},{"className":1004},[],[1006],{"type":93,"value":210},{"type":93,"value":212},{"type":87,"tag":104,"props":1009,"children":1010},{},[1011,1015],{"type":87,"tag":126,"props":1012,"children":1013},{},[1014],{"type":93,"value":220},{"type":87,"tag":126,"props":1016,"children":1017},{},[1018],{"type":93,"value":225},{"type":87,"tag":104,"props":1020,"children":1021},{},[1022,1026],{"type":87,"tag":126,"props":1023,"children":1024},{},[1025],{"type":93,"value":233},{"type":87,"tag":126,"props":1027,"children":1028},{},[1029],{"type":93,"value":238},{"type":87,"tag":104,"props":1031,"children":1032},{},[1033,1037],{"type":87,"tag":126,"props":1034,"children":1035},{},[1036],{"type":93,"value":246},{"type":87,"tag":126,"props":1038,"children":1039},{},[1040],{"type":93,"value":251},{"type":87,"tag":104,"props":1042,"children":1043},{},[1044,1048],{"type":87,"tag":126,"props":1045,"children":1046},{},[1047],{"type":93,"value":259},{"type":87,"tag":126,"props":1049,"children":1050},{},[1051],{"type":93,"value":264},{"type":87,"tag":104,"props":1053,"children":1054},{},[1055,1059],{"type":87,"tag":126,"props":1056,"children":1057},{},[1058],{"type":93,"value":272},{"type":87,"tag":126,"props":1060,"children":1061},{},[1062,1063,1068],{"type":93,"value":277},{"type":87,"tag":176,"props":1064,"children":1066},{"className":1065},[],[1067],{"type":93,"value":283},{"type":93,"value":285},{"type":87,"tag":88,"props":1070,"children":1071},{"id":288},[1072],{"type":93,"value":291},{"type":87,"tag":293,"props":1074,"children":1075},{},[1076],{"type":93,"value":297},{"type":87,"tag":293,"props":1078,"children":1079},{},[1080],{"type":93,"value":302},{"type":87,"tag":304,"props":1082,"children":1083},{},[1084,1100,1116,1126,1136],{"type":87,"tag":308,"props":1085,"children":1086},{},[1087,1088,1093,1094,1099],{"type":93,"value":312},{"type":87,"tag":176,"props":1089,"children":1091},{"className":1090},[],[1092],{"type":93,"value":318},{"type":93,"value":320},{"type":87,"tag":176,"props":1095,"children":1097},{"className":1096},[],[1098],{"type":93,"value":326},{"type":93,"value":328},{"type":87,"tag":308,"props":1101,"children":1102},{},[1103,1104,1109,1110,1115],{"type":93,"value":312},{"type":87,"tag":176,"props":1105,"children":1107},{"className":1106},[],[1108],{"type":93,"value":338},{"type":93,"value":340},{"type":87,"tag":176,"props":1111,"children":1113},{"className":1112},[],[1114],{"type":93,"value":346},{"type":93,"value":348},{"type":87,"tag":308,"props":1117,"children":1118},{},[1119,1120,1125],{"type":93,"value":312},{"type":87,"tag":176,"props":1121,"children":1123},{"className":1122},[],[1124],{"type":93,"value":358},{"type":93,"value":360},{"type":87,"tag":308,"props":1127,"children":1128},{},[1129,1130,1135],{"type":93,"value":312},{"type":87,"tag":176,"props":1131,"children":1133},{"className":1132},[],[1134],{"type":93,"value":370},{"type":93,"value":372},{"type":87,"tag":308,"props":1137,"children":1138},{},[1139,1140,1145],{"type":93,"value":377},{"type":87,"tag":176,"props":1141,"children":1143},{"className":1142},[],[1144],{"type":93,"value":383},{"type":93,"value":385},{"type":87,"tag":88,"props":1147,"children":1148},{"id":388},[1149],{"type":93,"value":391},{"type":87,"tag":293,"props":1151,"children":1152},{},[1153],{"type":93,"value":396},{"type":87,"tag":293,"props":1155,"children":1156},{},[1157,1158,1163,1164,1169],{"type":93,"value":401},{"type":87,"tag":176,"props":1159,"children":1161},{"className":1160},[],[1162],{"type":93,"value":407},{"type":93,"value":409},{"type":87,"tag":176,"props":1165,"children":1167},{"className":1166},[],[1168],{"type":93,"value":407},{"type":93,"value":416},{"type":87,"tag":293,"props":1171,"children":1172},{},[1173],{"type":93,"value":421},{"type":87,"tag":304,"props":1175,"children":1176},{},[1177,1181,1191],{"type":87,"tag":308,"props":1178,"children":1179},{},[1180],{"type":93,"value":429},{"type":87,"tag":308,"props":1182,"children":1183},{},[1184,1185,1190],{"type":93,"value":434},{"type":87,"tag":176,"props":1186,"children":1188},{"className":1187},[],[1189],{"type":93,"value":440},{"type":93,"value":442},{"type":87,"tag":308,"props":1192,"children":1193},{},[1194,1195,1200],{"type":93,"value":447},{"type":87,"tag":176,"props":1196,"children":1198},{"className":1197},[],[1199],{"type":93,"value":453},{"type":93,"value":455},{"type":87,"tag":88,"props":1202,"children":1203},{"id":458},[1204],{"type":93,"value":461},{"type":87,"tag":293,"props":1206,"children":1207},{},[1208,1209,1214],{"type":93,"value":466},{"type":87,"tag":176,"props":1210,"children":1212},{"className":1211},[],[1213],{"type":93,"value":472},{"type":93,"value":474},{"type":87,"tag":88,"props":1216,"children":1217},{"id":477},[1218],{"type":93,"value":480},{"type":87,"tag":293,"props":1220,"children":1221},{},[1222],{"type":93,"value":485},{"type":87,"tag":88,"props":1224,"children":1225},{"id":488},[1226],{"type":93,"value":491},{"type":87,"tag":293,"props":1228,"children":1229},{},[1230,1231,1236,1237,1242],{"type":93,"value":496},{"type":87,"tag":176,"props":1232,"children":1234},{"className":1233},[],[1235],{"type":93,"value":502},{"type":93,"value":504},{"type":87,"tag":176,"props":1238,"children":1240},{"className":1239},[],[1241],{"type":93,"value":510},{"type":93,"value":512},{"type":87,"tag":293,"props":1244,"children":1245},{},[1246],{"type":93,"value":517},{"type":87,"tag":88,"props":1248,"children":1249},{"id":520},[1250],{"type":93,"value":523},{"type":87,"tag":293,"props":1252,"children":1253},{},[1254,1255,1260,1261,1266],{"type":93,"value":528},{"type":87,"tag":176,"props":1256,"children":1258},{"className":1257},[],[1259],{"type":93,"value":534},{"type":93,"value":536},{"type":87,"tag":176,"props":1262,"children":1264},{"className":1263},[],[1265],{"type":93,"value":542},{"type":93,"value":544},{"type":87,"tag":88,"props":1268,"children":1269},{"id":547},[1270],{"type":93,"value":550},{"type":87,"tag":293,"props":1272,"children":1273},{},[1274,1275,1280,1281,1286,1287,1292,1293,1298],{"type":93,"value":555},{"type":87,"tag":176,"props":1276,"children":1278},{"className":1277},[],[1279],{"type":93,"value":561},{"type":93,"value":563},{"type":87,"tag":176,"props":1282,"children":1284},{"className":1283},[],[1285],{"type":93,"value":569},{"type":93,"value":571},{"type":87,"tag":176,"props":1288,"children":1290},{"className":1289},[],[1291],{"type":93,"value":561},{"type":93,"value":578},{"type":87,"tag":176,"props":1294,"children":1296},{"className":1295},[],[1297],{"type":93,"value":584},{"type":93,"value":586},{"type":87,"tag":88,"props":1300,"children":1301},{"id":589},[1302],{"type":93,"value":592},{"type":87,"tag":293,"props":1304,"children":1305},{},[1306],{"type":93,"value":597},{"type":87,"tag":88,"props":1308,"children":1309},{"id":600},[1310],{"type":93,"value":603},{"type":87,"tag":293,"props":1312,"children":1313},{},[1314],{"type":93,"value":608},{"type":87,"tag":88,"props":1316,"children":1317},{"id":611},[1318],{"type":93,"value":614},{"type":87,"tag":96,"props":1320,"children":1321},{},[1322,1336],{"type":87,"tag":100,"props":1323,"children":1324},{},[1325],{"type":87,"tag":104,"props":1326,"children":1327},{},[1328,1332],{"type":87,"tag":108,"props":1329,"children":1330},{},[1331],{"type":93,"value":628},{"type":87,"tag":108,"props":1333,"children":1334},{},[1335],{"type":93,"value":633},{"type":87,"tag":119,"props":1337,"children":1338},{},[1339,1350,1361,1372,1383,1394,1411,1422,1433,1444],{"type":87,"tag":104,"props":1340,"children":1341},{},[1342,1346],{"type":87,"tag":126,"props":1343,"children":1344},{},[1345],{"type":93,"value":644},{"type":87,"tag":126,"props":1347,"children":1348},{},[1349],{"type":93,"value":649},{"type":87,"tag":104,"props":1351,"children":1352},{},[1353,1357],{"type":87,"tag":126,"props":1354,"children":1355},{},[1356],{"type":93,"value":657},{"type":87,"tag":126,"props":1358,"children":1359},{},[1360],{"type":93,"value":662},{"type":87,"tag":104,"props":1362,"children":1363},{},[1364,1368],{"type":87,"tag":126,"props":1365,"children":1366},{},[1367],{"type":93,"value":670},{"type":87,"tag":126,"props":1369,"children":1370},{},[1371],{"type":93,"value":675},{"type":87,"tag":104,"props":1373,"children":1374},{},[1375,1379],{"type":87,"tag":126,"props":1376,"children":1377},{},[1378],{"type":93,"value":683},{"type":87,"tag":126,"props":1380,"children":1381},{},[1382],{"type":93,"value":688},{"type":87,"tag":104,"props":1384,"children":1385},{},[1386,1390],{"type":87,"tag":126,"props":1387,"children":1388},{},[1389],{"type":93,"value":696},{"type":87,"tag":126,"props":1391,"children":1392},{},[1393],{"type":93,"value":701},{"type":87,"tag":104,"props":1395,"children":1396},{},[1397,1401],{"type":87,"tag":126,"props":1398,"children":1399},{},[1400],{"type":93,"value":709},{"type":87,"tag":126,"props":1402,"children":1403},{},[1404,1405,1410],{"type":93,"value":714},{"type":87,"tag":176,"props":1406,"children":1408},{"className":1407},[],[1409],{"type":93,"value":720},{"type":93,"value":722},{"type":87,"tag":104,"props":1412,"children":1413},{},[1414,1418],{"type":87,"tag":126,"props":1415,"children":1416},{},[1417],{"type":93,"value":730},{"type":87,"tag":126,"props":1419,"children":1420},{},[1421],{"type":93,"value":735},{"type":87,"tag":104,"props":1423,"children":1424},{},[1425,1429],{"type":87,"tag":126,"props":1426,"children":1427},{},[1428],{"type":93,"value":743},{"type":87,"tag":126,"props":1430,"children":1431},{},[1432],{"type":93,"value":748},{"type":87,"tag":104,"props":1434,"children":1435},{},[1436,1440],{"type":87,"tag":126,"props":1437,"children":1438},{},[1439],{"type":93,"value":756},{"type":87,"tag":126,"props":1441,"children":1442},{},[1443],{"type":93,"value":761},{"type":87,"tag":104,"props":1445,"children":1446},{},[1447,1451],{"type":87,"tag":126,"props":1448,"children":1449},{},[1450],{"type":93,"value":769},{"type":87,"tag":126,"props":1452,"children":1453},{},[1454],{"type":93,"value":774},{"type":87,"tag":88,"props":1456,"children":1457},{"id":777},[1458],{"type":93,"value":780},{"type":87,"tag":293,"props":1460,"children":1461},{},[1462],{"type":93,"value":785},{"type":87,"tag":304,"props":1464,"children":1465},{},[1466,1470,1474,1478],{"type":87,"tag":308,"props":1467,"children":1468},{},[1469],{"type":93,"value":793},{"type":87,"tag":308,"props":1471,"children":1472},{},[1473],{"type":93,"value":798},{"type":87,"tag":308,"props":1475,"children":1476},{},[1477],{"type":93,"value":803},{"type":87,"tag":308,"props":1479,"children":1480},{},[1481],{"type":93,"value":808},{"type":87,"tag":293,"props":1483,"children":1484},{},[1485,1486,1491],{"type":93,"value":813},{"type":87,"tag":176,"props":1487,"children":1489},{"className":1488},[],[1490],{"type":93,"value":819},{"type":93,"value":821},{"type":87,"tag":88,"props":1493,"children":1494},{"id":824},[1495],{"type":93,"value":827},{"type":87,"tag":293,"props":1497,"children":1498},{},[1499],{"type":93,"value":832},{"type":87,"tag":293,"props":1501,"children":1502},{},[1503],{"type":93,"value":837},{"type":87,"tag":839,"props":1505,"children":1506},{"code":841},[1507],{"type":87,"tag":176,"props":1508,"children":1509},{"__ignoreMap":82},[1510],{"type":93,"value":841},{"type":87,"tag":88,"props":1512,"children":1513},{"id":849},[1514],{"type":93,"value":852},{"type":87,"tag":293,"props":1516,"children":1517},{},[1518,1519,1524],{"type":93,"value":857},{"type":87,"tag":176,"props":1520,"children":1522},{"className":1521},[],[1523],{"type":93,"value":863},{"type":93,"value":865},{"type":87,"tag":88,"props":1526,"children":1527},{"id":868},[1528],{"type":93,"value":871},{"type":87,"tag":293,"props":1530,"children":1531},{},[1532,1533,1538],{"type":93,"value":876},{"type":87,"tag":176,"props":1534,"children":1536},{"className":1535},[],[1537],{"type":93,"value":882},{"type":93,"value":884},{"title":82,"searchDepth":32,"depth":32,"links":1540},[1541,1542,1543,1544,1545,1546,1547,1548,1549,1550,1551,1552,1553,1554,1555],{"id":90,"depth":42,"text":94},{"id":288,"depth":42,"text":291},{"id":388,"depth":42,"text":391},{"id":458,"depth":42,"text":461},{"id":477,"depth":42,"text":480},{"id":488,"depth":42,"text":491},{"id":520,"depth":42,"text":523},{"id":547,"depth":42,"text":550},{"id":589,"depth":42,"text":592},{"id":600,"depth":42,"text":603},{"id":611,"depth":42,"text":614},{"id":777,"depth":42,"text":780},{"id":824,"depth":42,"text":827},{"id":849,"depth":42,"text":852},{"id":868,"depth":42,"text":871},1780603565198]