Security

Security information for GoatFlow and responsible disclosure policy.

Security

Security is a top priority for GoatFlow. This page outlines our security approach and how to report vulnerabilities.

Authentication & Identity Management

Multi-Provider Authentication

GoatFlow supports enterprise-grade authentication with multiple identity providers:

OIDC/OAuth2.0 Support: Native support for Google, Keycloak, Azure AD (Entra ID), and generic OIDC providers
Security Standards: PKCE (S256) mandatory, JWKS verification for token validation
LDAP Integration: Corporate directory integration for seamless user management
Auto-Provisioning: Automatic user creation and updates from identity providers
Flexible Provider Chain: Configure ordered provider lists for failover authentication

Two-Factor Authentication (TOTP)

Enterprise-grade 2FA protection for both agents and customers:

Authenticator App Support: QR code setup for TOTP apps (Google Authenticator, Authy, etc.)
Recovery Codes: 8 single-use recovery codes with 128-bit entropy
Login Verification: TOTP verification during authentication flow
Admin Override: Emergency admin capability to disable 2FA for locked-out users
Password Re-verification: Additional security before 2FA setup/disable
Comprehensive Audit: Full audit logging of all 2FA events
Session Security: 256-bit tokens with IP binding and rate limiting

API Security

Personal Access Tokens: Scoped permissions with configurable expiration
JWT Authentication: Secure token-based API authentication
Rate Limiting: Configurable rate limits per token
RBAC-Filtered Endpoints: Permission-based API access control

Enterprise Plugin Marketplace

GitHub-Based Distribution: Zero-infrastructure marketplace using GitHub Releases
ed25519 Signature Verification: Cryptographic plugin signing and automatic verification
Admin Marketplace UI: Full browse/install/update interface at /admin/marketplace
CLI Tooling: gk install/search/update commands for plugin management
Version Compatibility: Automatic compatibility checking with GoatFlow versions
Dependency Resolution: Automatic plugin dependency installation
Free Plugins: Community plugins including Knowledge Base available at no cost
Security Policies: Marketplace plugins inherit GoatFlow sandbox protections

Platform Security

Zero-Trust Architecture

Defense in Depth: Multiple security layers working together
Principle of Least Privilege: Minimal required access only
Comprehensive Audit Logging: Full audit trail of security-relevant events

Plugin Security Framework

GoatFlow’s industry-leading plugin sandbox provides:

OS-Level Process Isolation: Linux namespace isolation (CLONE_NEWNS, CLONE_NEWPID)
ed25519 Signature Verification: Cryptographic plugin signing and verification
SQL Table Whitelisting: Query parsing with table name scope enforcement
Resource Policies: Per-plugin CPU, memory, and network limits
Call Depth Limiting: Maximum 10-hop plugin-to-plugin chain protection
Config Key Blacklist: Sensitive patterns (passwords, secrets) blocked by default
Live Policy Updates: Real-time policy changes without restart
Email Rate Limiting: 10 emails/minute per plugin maximum
ZIP Extraction Security: Symlink detection, size/count limits
Blue-Green Reload: Atomic plugin updates without request drops

Infrastructure Security

Container Security:

Rootless Containers: All containers run as non-root user (UID 1000) for reduced attack surface (verified in Dockerfile)
Alpine Base Images: Minimal attack surface with Alpine Linux 3.19 (verified in Dockerfile)
Container Isolation: Security contexts and health checks implemented

Supply Chain Security:

SLSA Level 2 Compliance: Build provenance attestation using actions/attest-build-provenance@v1 (verified in build.yml lines 110-116)
Container Image Signing: cosign verification for container images (verified in build.yml)
SBOM Generation: Automatic Software Bill of Materials with sbom: true (verified in build.yml lines 98-99)
Multi-Architecture Builds: AMD64/ARM64 platform support (verified in build.yml lines 95, 179)
Security Scanning: Trivy comprehensive vulnerability/secret/misconfig scanning (Makefile: trivy-scan, trivy-images, security-scan), Semgrep SAST (managed scanning, 130 findings), gosec for Go security, govulncheck for vulnerability detection, staticcheck for code quality, Gitleaks for secret detection
Kubernetes Security: Comprehensive Helm chart SecurityContext policies (runAsNonRoot, readOnlyRootFilesystem, allowPrivilegeEscalation=false, drop ALL capabilities)
SELinux Compatibility: Host-level SELinux support with auto-detection for Podman volume mounts (:Z labels), proper security context handling for Fedora/RHEL systems
Password Security: bcrypt hashing for all user passwords

Web Security

Content Security Policy: XSS protection with strict CSP headers
HTTPS-Only: Secure communication enforcement
Input Validation: Comprehensive input sanitization
SQL Injection Prevention: Parameterized queries throughout
Session Management: Secure session handling with proper expiration

Access Control

Granular RBAC: OTRS-compatible permission service with 1,300+ auth tests
Group-Based Permissions: Queue and resource-level access control
Entity-Level Security: Hard delete with entity.hard_delete permission
Demo Mode Security: Restricted mode for public deployments

Data Protection

Entity Deletion: Soft delete with recycle bin, PII anonymisation
Secure Settings: AES-256-GCM encrypted plugin secrets
Multi-Tenancy: Organisation-based data isolation
Compliance: GDPR-ready data handling capabilities

Knowledge Base Plugin

Multi-Tenant Knowledge Base: Free plugin with article management and full-text search
Rich Text Editor: TipTap WYSIWYG with bluemonday-sanitized HTML output
Role-Based Access Control: Customer/agent/admin visibility and permissions
Advanced Search: Optional Zinc integration with field-weighted queries
OTRS/Znuny Import: Seamless FAQ XML import for legacy migrations
Media Management: Image paste/drop with attachment system
Category Taxonomy: Managed categories with article counts
Tag System: Tag chips with full-text indexing
Security Hardened: XSS prevention, input validation, org-scoped queries
Full i18n: All UI strings translated across 15 languages

Traditional Security Features

Implementation

Design Principles

Rootless Containers: All containers run as non-root user (UID 1000) - verified in Dockerfile
Alpine Base Images: Minimal attack surface with Alpine Linux 3.19 - verified in Dockerfile
Security Scanning: gosec, staticcheck, and Gitleaks integrated in CI/CD
Secure Defaults: Security-first configuration out of the box

Implementation

Input validation and sanitization
SQL injection prevention
XSS protection with Content Security Policy
Secure authentication and session management
HTTPS-only communication
bcrypt password hashing
LDAP/Active Directory integration
OIDC/OAuth2.0 authentication
Two-Factor Authentication (TOTP)
WebAuthn/Passkey support
Rate limiting (API and login)

Infrastructure Security

Container isolation and security contexts
Health checks and monitoring
Multi-architecture container builds (AMD64/ARM64)
SBOM and provenance generation
Regular security updates and patching

Response Process

Acknowledgment: Within 48 hours of report
Initial Assessment: Within 1 week
Fix Development: Timeline depends on severity
Coordinated Disclosure: After fix is available
Recognition: Credit in release notes (optional)

Security Updates

Critical security fixes are released immediately
Security updates are clearly marked in release notes
Subscribe to GitHub releases for notifications
Professional support customers get priority notifications

Contact

Security Team
Email: [email protected]
PGP Key: Available upon request

Response Time

Critical: Within 24 hours
High: Within 48 hours
Medium/Low: Within 1 week