Security & Credential Management
Relevant source files
The following files were used as context for generating this wiki page:
Security & Credential Management within NeXifyAI comprises a multi-layered governance framework designed to protect the platform's autonomous AI operations, sensitive credentials, and enterprise data. It operates under a Zero Trust architecture where every access requires explicit authorization and all operations are logged for auditability.
The system integrates specialized security agents—the security-engineer for implementation and the security-auditor for independent verification—into the NeXify Cognitive Execution Layer (NCEL). This ensures that security checks, secret scanning, and vulnerability assessments are automated parts of the CI/CD pipeline and agent execution cycles.
Security Governance Principles
The platform adheres to four core security pillars to maintain enterprise-grade integrity.
- Zero Trust: No internal network is assumed safe; all access requires explicit authorization.
- Defense in Depth: Governance layers are distributed across the Brain, Runtime, and CI/CD pipelines.
- Least Privilege: Every agent and service is restricted to the minimum capabilities required for its tasks.
- Audit Everything: The system logs every operation in an immutable audit log.
Sources: SECURITY.md:42-46, services/api/agents/brain_agents/senior-quality-auditor.md:46-47
Credential & Secret Management
NeXifyAI enforces strict isolation of secrets to prevent accidental exposure in source code or logs.
Secret Storage and Access
- Vault Integration: All secrets must reside in a secure vault (e.g., Data Vault or GitHub Secrets).
- Source Code Prohibition: The platform prohibits storing secrets directly in source code or configuration files.
- Local Security: On local environments, secrets are stored in
/root/.nexify/secrets/and must never be referenced directly by file path in code. - Environment Variables: Production secrets are injected via environment variables through platforms like Coolify or GitHub Actions.
Sources: SECURITY.md:58, services/api/agents/brain_agents/senior-quality-auditor.md:42, CLAUDE.md:27, SETUP.md:61-63
Critical Environment Keys
The following keys are required for system initialization:
| Key | Service | Purpose |
|---|---|---|
ALT_SUPABASE_SERVICE_ROLE_KEY | Supabase | Database API Access |
NEXIFY_API_KEY | NeXify LLM | AI Model Authentication |
SECRET_KEY | JWT | Token Signing (Min 32 chars) |
MONGO_URL | MongoDB | Database Connection |
Sources: SETUP.md:12-20
Automated Security Scanning
Security scanning is integrated into the CI/CD pipeline to block vulnerabilities before they reach production.
The diagram shows the automated security verification flow where multiple scanners must pass to avoid a deployment block.
Security Tooling
- Gitleaks: Scans every push for exposed secrets.
- Trivy: Performs container vulnerability scanning, blocking on HIGH or CRITICAL findings.
- NPM Audit / Safety: Checks JavaScript and Python dependencies for known vulnerabilities.
- Dependabot: Automates dependency updates to patch security gaps.
Sources: SECURITY.md:48-55, services/api/agents/brain_agents/security-auditor.md:26
Security Agent Architecture
The platform utilizes specialized agents to manage and audit security posture autonomously.
Security Engineer (security-engineer)
The security-engineer implements security controls. Its checklist includes:
- Enforcing HTTPS and HSTS across all endpoints.
- Implementing Content Security Policy (CSP).
- Managing the Secret Vault to GitHub Secrets pipeline.
- Establishing incident response levels (Info, Warning, Critical).
Sources: services/api/agents/brain_agents/security-engineer.md:1-40
Security Auditor (security-auditor)
The security-auditor provides independent verification of the security-engineer's work.
- Workflow: Analyzes code patterns, queries the Brain for known vulnerabilities, flags findings by severity, and provides remediation guidance.
- Scope: Audits Auth/Authz, data encryption, API security, and infrastructure (ports/firewalls).
- Audit Cycle: Performs weekly automated "Light Audits" and quarterly manual/automated "Full Audits."
Sources: services/api/agents/skill_registry/skills/security-auditor/SKILL.md:16-32, services/api/agents/brain_agents/security-auditor.md:18-45
Quality Gates and Security Compliance
Security is the third gate in the mandatory 7-gate deployment process overseen by the senior-quality-auditor.
Gate 3 — Security Requirements
A deployment is blocked if any of these conditions are not met:
- Secrets: All secrets are in the vault; none are in code.
- Ports: No unnecessary ports are open.
- Auth: Every endpoint is authenticated via JWT or
X-Internal-Auth. - Audit Log: All changes are logged in an immutable format.
- RBAC: Role-Based Access Control is enforced with least privilege.
Sources: services/api/agents/brain_agents/senior-quality-auditor.md:41-47
Vulnerability Disclosure Policy
NeXifyAI maintains a formal process for reporting security issues. Reporters must not create public GitHub issues. Reports should be sent encrypted via PGP to security@nexifyai.de.
Response Timeline
| Phase | Timeline |
|---|---|
| Acknowledgment | Within 24 hours |
| Initial Assessment | Within 72 hours |
| Fix Development | 7 days (Critical) / 30 days (High) |
| Public Disclosure | 90 days after fix |
Sources: SECURITY.md:5-24
Summary
Security and Credential Management in NeXifyAI is a programmatic, agent-driven system that enforces Zero Trust and Least Privilege. By integrating automated scanning tools like Gitleaks and Trivy with specialized Security and Quality agents, the platform ensures that secrets are never exposed and all deployments undergo rigorous, multi-stage security validation.