Security

Enroute is unaudited. Security fixes go out in the next release, and there are no backports to earlier ones. Report vulnerabilities to security@enroute.sh.

Your application authenticates users and supplies product policy through hooks. Its security controls are part of the deployment boundary.

API access

Enroute does not terminate TLS or authenticate gRPC callers. Any caller that can reach the API listener can read, write, and delete every repository in the deployment.

Reachability is therefore the whole of the control. Bind listen.api to a private interface, and restrict it further with a network policy, a security group, or a service mesh. gRPC reflection is served on the same listener, so do not expose it if your API shape is confidential.

Git access

The authorize hook is the only access control on listen.git. If you do not enable it, anyone who can reach the listener can read and push every repository, and a push creates new ones. Enroute logs a warning at startup when authorize is off and listen.git is not bound to a loopback address.

Never expose listen.git with authorize off. Enable it in hooks.enabled before you bind Git to any interface other than loopback. See Enable hooks.

Hook signatures

Enroute signs each hook with Ed25519 HTTP Message Signatures (RFC 9421). Distribute the public key to each application and verify every request before reading its body. Generate a separate key for each environment:

openssl genpkey -algorithm ed25519 -out hook-signing-key.pem

Reference the private key through ENROUTE_HOOK_SIGNING_KEY. enroute dev keeps a generated key in its directory. Use that key only for local development. See Verify hook signatures.

Other boundaries

PushToRemote discards credentials after each call. It rejects credentials in URLs and redirects, and permits only public https hosts unless git.allow_private_remotes is enabled.

A deployment holds one application's repositories. Enroute enforces no boundary inside that set: every key is reachable by whoever reaches the API listener, and by whatever your authorize hook grants. To serve parties that must not reach each other's repositories, run a deployment per party, each with its own bucket and node disks.

Enroute validates Git paths, repository keys, hook-context size, and ref targets. It does not provide rate limits, quotas, per-caller concurrency limits, encryption at rest, or protection against a compromised application.