Security Policy

1. Overview

Security is a core design goal of CorvusTunnel. Because CorvusTunnel grants remote control over AI coding agents — and, through them, your shell and your code — we treat the security of the project with the seriousness it deserves.

This policy describes how CorvusTunnel protects your data, what we ask of users running their own deployments, and how to report a vulnerability responsibly.

2. Security Model

CorvusTunnel is built on a defense-in-depth approach. The most important properties are:

• End-to-end encryption: X25519 key exchange combined with XSalsa20-Poly1305 authenticated encryption (NaCl/libsodium). Plaintext never leaves your machine or your device.
• Zero-knowledge relay: The relay at roost.corvustunnel.com routes only ciphertext. It cannot read, log, or modify your content.
• Ephemeral authentication: One-time boot tokens delivered via QR code are exchanged for short-lived session tokens. No long-lived credentials are stored on disk.
• Hardened transport: WebSocket access requires a separately issued ticket, scoped per session.

3. Hardening Measures

The CorvusTunnel server enforces multiple layers of protection by default:

• Automatic IP banning after repeated authentication failures
• Configurable rate limiting on all endpoints
• Request body size limits to mitigate resource-exhaustion attacks
• Strict CORS policy and security response headers
• Append-only JSONL audit logging of prompts, outputs, and approvals

4. Your Responsibilities

CorvusTunnel is self-hosted software. While we ship secure defaults, the security of your deployment ultimately depends on you. We recommend that you:

• Keep CorvusTunnel updated to the latest released version
• Run it only on infrastructure you trust and control
• Never share boot-token QR codes over insecure channels
• Review the audit logs periodically
• Restrict agent permissions to the minimum your workflow requires

5. Responsible Disclosure

If you discover a security vulnerability in CorvusTunnel, we ask that you report it privately so we can investigate and issue a fix before public disclosure.

When reporting, please include:

• A clear description of the vulnerability and its potential impact
• Step-by-step reproduction instructions
• The affected version or commit, if known
• Any suggested remediation, if you have one

6. Our Commitment

When you report a vulnerability in good faith, we commit to:

• Acknowledging your report within a reasonable timeframe
• Keeping you informed of our progress as we investigate
• Working to remediate confirmed issues promptly
• Crediting you for the discovery, if you wish

We will not pursue legal action against researchers who follow this policy and act in good faith, without compromising user data or disrupting the relay service.

7. Scope

This policy covers the open-source CorvusTunnel software and the relay service at roost.corvustunnel.com. Issues in third-party AI agents (such as Claude Code, Codex CLI, or Antigravity) or in your own infrastructure should be reported to the respective vendors.

8. Contact

For all security-related inquiries:

KALAI
Security: [email protected]
Web: kalai-tech.com