Security

CIFP exists to hold the most sensitive material you have — live API credentials — so security is not a feature list; it is the architecture. This page explains the layers, from the cryptography protecting secrets at rest to the physical isolation of each proxy, and why the platform is engineered to remain safe even against adversaries with future quantum computers.

Threat Model

CIFP is designed around three assumptions:

• Clients get compromised. Agents, CI runners, and laptops leak. That is why they only ever hold short-lived, revocable proxy credentials — never your real keys.
• Traffic gets recorded. Adversaries harvest encrypted traffic today to decrypt it when quantum hardware matures ("harvest now, decrypt later"). CIFP's cryptography is selected to make that strategy worthless.
• Neighbours can't be trusted. Multi-tenant platforms fail at the boundary. CIFP gives every proxy its own virtual machine and its own IP — there is no shared boundary to fail.

Quantum Resilience

Two properties make CIFP quantum-resilient today, without waiting for an industry migration:

AES-256-GCM at rest — already post-quantum

Every secret is encrypted with AES-256-GCM using a per-tenant 256-bit key. Symmetric cryptography at this strength is already considered quantum-safe: Grover's algorithm — the best known quantum attack on symmetric ciphers — only halves the effective key strength, leaving AES-256 with ~128 bits of post-quantum security. That remains computationally infeasible for any adversary, quantum or classical. A recording of CIFP's storage stolen today cannot be decrypted by tomorrow's quantum computer.

Hybrid post-quantum key exchange in transit

CIFP's control-plane services are built on Go 1.25, whose TLS stack negotiates X25519MLKEM768 by default — a hybrid of classical X25519 and ML-KEM-768, the NIST-standardised (FIPS 203) post-quantum key-encapsulation mechanism. When both endpoints support it, session keys are protected by both algorithms simultaneously: an attacker would need to break classical elliptic-curve cryptography and the lattice-based ML-KEM to recover traffic. Recorded control-plane traffic is therefore resistant to harvest-now-decrypt-later attacks.

Client-to-proxy connections negotiate the strongest suite your client offers — modern browsers, Go, and OpenSSL 3.5+ clients already speak hybrid post-quantum TLS, and CIFP benefits automatically as the ecosystem converges.

Encryption at Every Layer

Isolation by Construction

• Dedicated VM per proxy — no shared kernel, no shared memory, no noisy or nosy neighbours
• Dedicated IP per proxy — your traffic never shares an address with another tenant
• Secrets never leave the machine — decryption happens inside the proxy VM at injection time; the control plane stores and ships only ciphertext
• Per-port credential scoping — bind a credential to a single port so one client can reach exactly one secret and nothing else

Request-Level Defense

Cryptography protects secrets; the firewall engine protects how they are used:

• CEL policy on every request — allow, deny, or hold based on method, host, path, headers, and body sample
• Human-in-the-loop holds — suspicious requests pause for explicit approval in the dashboard
• Response sanitisation — credentials are stripped from responses and redacted from log samples, so a secret can't boomerang back to the client
• IP allowlisting — connections from unknown source addresses are refused outright
• Full audit trail — every request logged with the action taken and the rule that decided it

Anti-Fingerprinting

CIFP proxies are deliberately quiet. Error pages, headers, and stylesheets that would normally reveal the proxy software are stripped to zero bytes, denying attackers the reconnaissance foothold that automated scanners depend on.

Containing the Blast Radius

The practical payoff of this architecture is what happens on a bad day:

• A compromised agent yields only a revocable proxy credential — revoke it and the incident is over; no upstream key rotates, no deployment changes
• A stolen storage snapshot yields only AES-256 ciphertext — unreadable now, and unreadable in the quantum era
• Recorded network traffic is hybrid-PQ protected — worthless to a harvest-now-decrypt-later adversary
• A breached tenant is an island — dedicated hardware and per-tenant keys mean nothing propagates

Combine this with expiry notifications and access logs, and you have a platform where credentials are not just hidden — their entire lifecycle is governed, observed, and future-proofed.