Security Principles
Hexr is built on three security principles:- Identity-first — every process has a cryptographic SPIFFE identity
- Zero standing access — credentials are short-lived and scoped
- Defense-in-depth — multiple layers, no single point of failure
Security Layers
Layer 1: Identity
Layer 1: Identity
SPIFFE/SPIRE — Every process gets a unique X.509 SVID. Per-process identity, not just per-pod.
Layer 2: Transport
Layer 2: Transport
Envoy mTLS — All inter-service traffic is encrypted with mutual TLS using SPIFFE certificates.
Layer 4: Credentials
Layer 4: Credentials
Credential Injector — Short-lived cloud tokens (15-60 min TTL). 3-tier cache with per-identity isolation.
Layer 5: GenAI
Layer 5: GenAI
LLM Guard — Prompt injection detection, PII scanning, secrets scanning, invisible text detection.
Layer 6: Isolation
Layer 6: Isolation
Firecracker Sandbox — microVM code execution with hardware-level isolation. Kubernetes Namespaces — tenant isolation.
What Each Layer Protects
Compliance
See Compliance Frameworks for details.
Deep Dives
SPIFFE Identity
How per-process identity works.
OPA Policies
Write authorization policies.
Threat Model
Attack chains and mitigations.
OWASP GenAI
OWASP Top 10 for GenAI compliance.