Security at KeyLens
Trust is earned through transparency. Here's how we protect your code, your data, and our supply chain.
Data Handling
KeyLens is designed with a zero-trust data model. Your source code never leaves your infrastructure.
- ✅All scanning happens locally
The KeyLens CLI runs entirely on your machine or CI/CD runner. No source code, CBOM output, or metadata is transmitted to any external server.
- ✅CBOM output stored on your infrastructure
Generated CBOMs are written to local files. You control where they're stored, who can access them, and how long they're retained.
- ✅No telemetry without explicit opt-in
KeyLens collects zero usage analytics, crash reports, or telemetry data by default. If you choose to enable anonymous usage statistics (to help us prioritize features), it requires explicit configuration.
- ✅No network calls during scanning
KeyLens does not fetch external resources during a scan. Tree-sitter grammars and Rego policies are bundled in the binary. The tool works fully air-gapped.
Supply Chain Security
We take our own supply chain as seriously as we take yours.
- 🔒Rust crate dependencies audited with cargo-deny
Every dependency is checked against the RustSec advisory database on every CI build. Unmaintained or vulnerable crates are flagged and replaced.
- 🔒Reproducible builds
Our release pipeline produces bit-for-bit reproducible binaries. You can verify that the binary you download matches the source code in our public repository.
- 🔒Signed checksums for every release
Every release includes SHA-256 checksums signed with our release key. Verify the integrity of downloads before deployment.
- 🔒Minimal dependency footprint
KeyLens compiles to a single static binary (~15MB) with zero runtime dependencies. No JVM, no Docker daemon, no Node.js — just a standalone executable.
- 🔒SBOM published with every release
We practice what we preach. Every KeyLens release includes a CycloneDX SBOM documenting all included dependencies.
Vulnerability Disclosure
We welcome responsible disclosure of security vulnerabilities. If you discover a security issue in KeyLens, please report it through our responsible disclosure process.
Disclosure Policy
- →Please provide sufficient detail to reproduce the vulnerability
- →Allow us reasonable time to address the issue before public disclosure
- →Do not access or modify user data without explicit permission
- →We commit to not pursuing legal action against good-faith security researchers
Compliance Certifications
SOC 2 Type II
Audit initiated with independent assessor. Expected completion Q3 2026. Covers security, availability, and confidentiality trust service criteria.
Expected: Q3 2026FedRAMP
FedRAMP authorization planned for KeyLens Cloud (SaaS). Pursuing Moderate baseline for government deployment.
Planned: Q4 2026MPL-2.0 Licensed
Permissive open source license compatible with enterprise use. Source code publicly auditable on GitHub.
Since inceptionInfrastructure Security
For organizations using KeyLens Enterprise or the upcoming KeyLens Cloud:
- 🏢Self-hosted deployment
Run KeyLens entirely within your infrastructure. No external dependencies. Supports air-gapped environments.
- 🔐SSO / SAML integration
Enterprise deployments support SAML 2.0, OIDC, and integration with major identity providers (Okta, Azure AD, PingFederate).
- 📋Audit logging
Tamper-proof audit logs for every scan, policy evaluation, and configuration change. Exportable to SIEM platforms (Splunk, Elasticsearch).
- 🛡️Role-Based Access Control (RBAC)
Granular permissions per team, project, and repository. Least-privilege model for scan configurations and policy management.