STONEWAYdocs
sign in / dashboard[github]

SECURITY POLICY & ARCHITECTURE

← back to home

1. Cryptographic Invariants

  • Authentication: API bearer keys are verified via deterministic SHA-256 hash lookup in Neon Postgres. Raw keys are never stored in plain text.
  • Envelope Encryption: Third-party integration credentials and revealable token backups are encrypted at rest with AES-256-GCM using a unique 96-bit Initialization Vector (IV) and 128-bit authentication tag per write.
  • Zero Plaintext Secret Exposure: Credentials never touch server logs or MCP tool outputs.

2. Responsible Disclosure

If you discover a vulnerability, please report it privately via GitHub Security Advisories on the repository: https://github.com/itsjustayush/StoneWay-MCP/security/advisories. Do not file public issues for active security vulnerabilities.