Skip to content

Security Overview

MazeVault Security Architecture and Defense-in-Depth Strategy

Document Version: 1.0.0
Last Updated: 2026-02-10

1. Security Architecture

MazeVault implements a defense-in-depth security strategy with multiple protective layers:

graph TB
    subgraph L1["Layer 1: Network"]
        FW["🛡️ Firewall / NSG"]
        TLS["🔒 TLS 1.2+ Enforcement"]
        WAF["🌐 Web Application Firewall"]
    end

    subgraph L2["Layer 2: Application"]
        RL["⏱️ Rate Limiting"]
        CORS["🎯 CORS Validation"]
        CSRF["🛡️ CSRF Protection"]
        Input["✅ Input Validation"]
    end

    subgraph L3["Layer 3: Authentication"]
        MFA["🔐 Multi-Factor Auth"]
        SSO["🆔 SSO / SAML / OIDC"]
        SRP["🤝 SRP Protocol"]
        JWT["🎫 JWT Token Mgmt"]
    end

    subgraph L4["Layer 4: Authorization"]
        RBAC["👥 Role-Based Access"]
        Project["📁 Project Isolation"]
        Perm["🔑 Granular Permissions"]
    end

    subgraph L5["Layer 5: Data"]
        AES["🔐 AES-256-GCM Encryption"]
        ZK["👁️‍🗨️ Zero-Knowledge Architecture"]
        HSM["🏦 HSM Key Protection"]
        Audit["📝 Audit Logging"]
    end

    L1 --> L2 --> L3 --> L4 --> L5

    classDef network fill:#F5F5F5,stroke:#9E9E9E,stroke-width:2px,color:#424242
    classDef app fill:#EBF5FB,stroke:#2196F3,stroke-width:2px,color:#1565C0
    classDef auth fill:#FFF8E1,stroke:#FF9800,stroke-width:2px,color:#E65100
    classDef authz fill:#E8F5E9,stroke:#4CAF50,stroke-width:2px,color:#2E7D32
    classDef data fill:#E8EAF6,stroke:#3F51B5,stroke-width:2px,color:#283593

    class FW,TLS,WAF network
    class RL,CORS,CSRF,Input app
    class MFA,SSO,SRP,JWT auth
    class RBAC,Project,Perm authz
    class AES,ZK,HSM,Audit data

2. Security Principles

Principle Implementation
Zero Trust All communication authenticated and encrypted; no implicit trust between components
Zero Knowledge Platform encrypts data with customer-controlled keys; plaintext never accessible to operators
Least Privilege RBAC with granular permissions; users access only what their role permits
Defense in Depth Five security layers — network, application, authentication, authorization, data
Secure by Default All security features enabled by default; opt-out rather than opt-in
Audit Everything Every data access and modification recorded with full user context

3. Transport Security

TLS Configuration

Parameter Value
Minimum TLS Version 1.2
Preferred TLS Version 1.3
Certificate Validation Required in production
HSTS Enabled (max-age=31536000, includeSubDomains)
Certificate Pinning Supported for agent-to-server communication

Security Headers

All HTTP responses include the following security headers:

Header Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-XSS-Protection 1; mode=block
Strict-Transport-Security max-age=31536000; includeSubDomains
Referrer-Policy strict-origin-when-cross-origin
Content-Security-Policy Restrictive policy limiting resource origins
Permissions-Policy Restrictive policy disabling unnecessary browser APIs

4. Application Security

Rate Limiting

Endpoint Category Limit Window
Authentication 10 requests 1 minute
API (authenticated) 100 requests 1 minute
OCSP 1000 requests 1 minute
Health checks Unlimited —

Input Validation

  • All API inputs validated against JSON schemas
  • SQL injection prevention through parameterized queries
  • XSS prevention through output encoding and Content Security Policy
  • Path traversal prevention through input sanitization
  • Request body size limits enforced at ingress level

CORS Policy

  • Strict origin allowlisting (no wildcards in production)
  • Credentials mode requires explicit origin specification
  • Preflight caching for performance

CSRF Protection

  • Double-submit cookie pattern
  • SameSite cookie attribute (Strict/Lax based on context)
  • Custom header verification for API requests

5. Data Security Summary

Data Category Encryption at Rest Encryption in Transit Access Control
Secrets AES-256-GCM TLS 1.2+ RBAC + Project
Private Keys AES-256-GCM + HSM TLS 1.2+ RBAC + Project
Certificates Database-level TLS 1.2+ RBAC + Project
User Credentials bcrypt/Argon2 hash TLS 1.2+ Self + Admin
Session Tokens AES-256-GCM TLS 1.2+ (Secure cookie) Self
Audit Logs Database-level TLS 1.2+ Admin only

6. Vulnerability Management

Practice Frequency Description
Dependency Scanning Continuous Automated scanning of all dependencies for known CVEs
Container Scanning Per build Docker image scanning with Trivy
Penetration Testing Annual Third-party security assessment
Code Review Per change Mandatory review for all security-relevant changes
Security Patching As needed Critical patches within 48 hours, High within 7 days