Security

Self-hosted. Air-gap works. No phone-home.

Entitlement verification is local. Report vulnerabilities to the address below.

Disclosure

Email security@latticeddi.com. We do not run a public bug bounty. Include the version string and a reproduction that does not require production customer data.

Canonical file: /.well-known/security.txt.

What ships

  • Runs on your hosts. Air-gap capable (save-bundle).
  • Ed25519 public key compiled into the binaries. The unsigned cap is never trusted.
  • Bearer tokens stored as SHA-256, shown once. The API is the security boundary.
  • Until the first token exists, the API is loopback-only. The installer writes bootstrap.token.
  • The console keeps the token in this tab, not across sessions.
  • HA join tokens work once. On the primary, lattice-install --mode join-token mints the next. Cluster does not show them.
  • The console is HTTPS on 443 (self-signed until you replace the cert). Port 8080 on the box is not how you reach the UI from another host.

Fleet

Agents connect outbound (WSS). Cluster API tokens and SSH keys encrypt at rest when configured. Break-glass is time-limited and audited. DHCP does not traverse Fleet. No phone-home.

Supported versions

The last published tarball may lag main. Report issues against the version string you actually run. security@latticeddi.com.