Security

Zenavo holds credentials for servers you own, so security comes first in its design.

Your servers

• Zenavo connects with a key only it holds. A password you enter is used once to install that key and never stored.
• Host keys are pinned on first connection; Zenavo refuses to connect if a server's host key changes.
• The Kubernetes API needs a client certificate held only by Zenavo. Restrict ports 22 and 6443 to the control plane (Firewall & Security).
• Each server can pull only its own team's images from Zenavo's registry.

Builds

Git builds run on dedicated build machines with no cloud identity, no public address and no route to the control plane or other customers. Build steps cannot reach the cloud metadata service or private networks. BuildKit runs rootless and accepts only Zenavo's client certificate. Repository URLs are limited to https:// and SSH on public addresses, without redirects.

Your data

• Variables, SSH keys and cluster credentials are encrypted at rest. Variable values are redacted from logs and hidden from viewers.
• The control plane database accepts only encrypted, certificate-verified connections.
• GitHub access uses short-lived installation tokens scoped to the repositories you selected.

Your account

• Passwords are hashed; sessions last 12 hours and can be signed out from Account settings.
• Session cookies are HttpOnly, Secure and host-only (__Host-), and every change requires a same-origin request with Zenavo's request header.
• Two-factor authentication and an audit log are on the roadmap.

Report a vulnerability

Email info@zenavo.app. Please give us a chance to fix the issue before disclosing it.