Security by design, not slogan
Currixa is infrastructure others depend on, so every layer assumes zero trust: each request is verified anew.
Zero Trust
No difference between an internal and an external request. No path skips authentication for being internal.
Tenant isolation
Every request operates inside one explicit tenant from the verified token, and the database enforces isolation with row-level policies.
Least privilege
Permissions come from a closed catalog, read from the current tenant's membership on every request. No wildcard defaults.
Two-factor publishing
Publish and admin permissions require a session verified with a second factor, and are refused without one.
Undeletable audit
Every publish, role grant, and review bypass is recorded in an append-only, hash-chained (SHA-256) log — no deletion for any role.
Immutable versions
Published content is never silently edited. A correction is a new version or an announced Erratum.
Environment and secret isolation
Production secrets live in two places, outside the code and the repository: protected files on the API server, and the web host's encrypted environment variables, set per environment. The ones the admin panel manages are sealed under a master key and never shown again. No secret in code or the browser.
AI governance
AI outputs are candidates only. No automatic publishing, no permission changes, no audit-log access.
Report a vulnerability
Found a security issue? Write to the email below with “security” in the subject. Do not publish the issue before we address it.
Our responsible disclosure policy
/.well-known/security.txt
What we do not claim
We claim no SOC 2, no ISO 27001, and no certified penetration test. What is documented above works and is covered by automated tests; the rest we do not promise.