Security must be structural.

UNBLOCK connects identities, memory, tools, permissions, and machines. Security is therefore part of the product model—not a feature added after it.

CURRENT POSTURE

Private beta. Scoped access. Honest boundaries.

We are still hardening the system and expanding independent verification. This page describes the controls and principles in the current architecture without implying a certification or audit we have not completed.

Credentials stay out of the browser

The Web UI uses a server-side gateway for upstream access so service credentials are not exposed to client-side JavaScript.

Authority is scoped

Identities, roles, grants, and revocation define who or what may read, write, decide, and execute.

Every action has an actor

Human and agent activity remains attributable to a durable identity and organizational scope.

The boundary is visible

Privacy, audit posture, and permission requests are designed to be legible to the people affected by them.

Beta access is deliberate

UNBLOCK remains in private beta while its security model, operational controls, and enterprise boundaries are hardened.

Claims stay inside evidence

We distinguish shipped controls from planned controls and do not present roadmap work as production protection.

REPORT A VULNERABILITY

Tell us privately and directly.

Email virajsharma@kaeva.app with the affected surface, reproduction steps, and potential impact. We will acknowledge receipt and coordinate next steps.

View security.txt ↗