BitzOrcas implements a comprehensive security model designed for SaaS multi-tenant environments. Security is enforced at multiple layers — authentication, authorization, tenant isolation, and request integrity.
Security surface
| Layer | Implementation | Status |
|---|---|---|
| Authentication | JWT / HMAC / API Key (3 schemes) | ✅ Implemented |
| Authorization | RBAC + ABAC + AppScope + ReBAC | ✅ Implemented |
| CORS & Headers | ASP.NET Core CORS configuration | ✅ Implemented |
| Impersonation | Delegation tokens (operator impersonation) | ✅ Implemented |
| Webhook signing | HMAC-SHA256 request signing | ✅ Implemented |
| Production checklist | Deployment security checklist | ✅ Documented |
| 2FA/TOTP | TOTP authenticator | 📋 Planned |
| Data protection | Encryption at rest | 📋 Planned |
Design principles
- Fail-fast: Missing secrets cause immediate startup failure — no default weak keys
- Fail-closed: Unconfigured authentication schemes reject all requests
- No plaintext secrets: API keys are SHA-256 hashed; JWT secrets are validated for minimum length
- Tenant isolation: All data queries are tenant-filtered by default
- Audit trail: All security-relevant operations are logged
Threat model
BitzOrcas’s security addresses common SaaS threats:
| Threat | Mitigation |
|---|---|
| Token theft | Short JWT lifetime + HMAC nonce anti-replay |
| Credential leakage | API keys stored as SHA-256 hashes, never plaintext |
| Tenant data leakage | Global query filters enforce isolation |
| Brute force | Sliding window rate limiting on auth endpoints |
| Replay attacks | HMAC nonce store with expiration |
| CSRF | No cookie-based auth — all token-based |
See also
- Auth flow diagram — Visual authentication flow
- Identity module — RBAC permission model
- Multitenancy deep dive — Tenant isolation