Security

The gateway is our security perimeter. Everything outside it is untrusted; everything inside it is ours.

Threat Model

Threat	Mitigation
Compromised consumer credential	Scoped permissions, per-consumer rate limits, audit log
Compromised vendor credential	Rotation, Doppler, short-lived tokens
Replayed webhook	Signature verification + timestamp window
Forged webhook	Signature verification
PII leakage in logs	Field-level scrubbing, schema-tagged PII
DoS via consumer	Per-consumer rate limits, circuit breakers
DoS via vendor	Vendor quota tracking, backpressure
Vendor SDK vulnerability	Vendors live inside the gateway only; consumer processes never see them

Secrets Management

• All our vendor credentials in Doppler
• All consumer credentials in Doppler
• Local development uses .env with placeholder values; CI uses ephemeral secrets
• Secret rotation supported; multiple active versions during rotation

The spike stores the JWT private key on disk in certs/. This is acceptable for the spike; it is not acceptable for production.

Network

• All calls to our resources over HTTPS
• TLS 1.2 minimum
• Certificate verification on (no rejectUnauthorized: false anywhere in production)
• Outbound IPs allowlisted with vendors where possible

Inbound Auth

• API key + secret (or mTLS) required on every endpoint except /v1/healthz
• Keys are opaque, high-entropy, scoped to a single consumer
• Failed auth attempts are logged and rate-limited
• Successful auth emits a consumer_id in all subsequent logs and traces

Webhook Security

• Signature verification on every inbound webhook (vendor signature for resource webhooks, gateway signature for consumer webhooks)
• Replay protection via timestamp window (5 minutes)
• Dedupe via event ID

PII Handling

• Member PII is logged at the field level, not in raw payloads
• Logs scrub email, phone, payment_* fields by default
• PII fields are tagged in the OpenAPI schema; the logging layer enforces scrubbing based on tags
• Audit log of every PII access, retained per compliance requirements

Input Validation

• Every endpoint validates input against a JSON Schema
• Reject unknown fields (no silent extras)
• Reject oversized payloads (per-endpoint limits)
• Reject unexpected content types

Rate Limiting

Protects against credential abuse and accidental runaway consumers. See Rate Limiting.