Verifiable Security Architecture
github.com/rasnu/os-agent ↗ /.well-known/security.txt →

Security you can verify — proven in open-source code.

Connecting an operations platform to production servers requires verifiable boundaries, not marketing promises. RasnuOS never asks for root SSH keys, never opens an inbound port on your firewall, and pauses every state-changing command for human approval.

Network Surface
0 Inbound Ports
Outbound HTTPS (:443) only
Execution Control
Human Approval Gate
Safety checks + 1-click undo
Password Safety
Memory-Only
Cleared after use · 0 bytes on disk
Audit History
Tamper-Evident
Cloud + server log + CSV export
Six Verifiable Controls

How RasnuOS protects your hosts at every layer.

Plain-language guarantees on every card. Click any specification drawer to inspect the exact engineering implementation.

01 · Open Source Source ↗

Auditable Open-Source Agent

Never run a mystery binary with root privileges. The entire host agent is public on GitHub and compiles into a single static binary for Linux, macOS, and Windows (amd64 & arm64) with zero runtime dependencies.

Test Coverage: Continuously verified by an automated test suite with concurrency checks before any release is published.
Footprint: < 15 MB binary · 20–40 MB idle RAM · no Python, Node, or Docker required.
02 · Supply Chain Deep Dive →

Signed Releases & Safe Updates

Every release is digitally signed offline before it ships. Before installing or applying an update, the agent verifies its digital signature and integrity—refusing the update automatically if a single byte was altered.

Offline Signing: Release builds are signed offline to produce a detached digital signature alongside the release manifest.
Safe Replacement: If verification fails, the downloaded file is deleted immediately and your running agent remains untouched.
03 · Execution Gate Engine Spec →

Built-In Safety Checks & Human Approval

Read-only diagnostics run automatically. Any command that edits configs, restarts services, or alters system state pauses behind an Approval Card with a visual diff, automatic .bak backup, and 1-click Undo.

Cloud + Server Enforcement: Automatically blocks disguised scripts, evaluates command risk, and enforces built-in operating system protection rules in both the cloud and directly on your server.
04 · Network Isolation HTTPS :443

Outbound Port 443 & Verified Connections

The agent connects outward over port 443 and never listens on a public port. When migrating workloads between two servers, files stream directly host-to-host over a single-use encrypted connection without touching our cloud storage.

Certificate Verification & Rate Protection: Verifies the control plane's certificate fingerprint on every connection and protects against runaway command loops.
Direct Migration & Metrics: Creates a single-use encrypted connection per migration job, and binds optional Prometheus /metrics strictly to 127.0.0.1:9090.
05 · Zero-Disk Secrets Memory-Only

Single-Use In-Memory Task Secrets

Passwords are encrypted in your vault and sent to the agent strictly in temporary memory for a single approved task. They are passed only to that command and cleared immediately after use—never written to disk.

Single-Use Retrieval: Task secrets are deleted from temporary memory on first read and automatically expire if unused.
Automatic Log Masking: Execution logs record only [VAULT] Injected: KEY=***REDACTED*** and mask password patterns before transport.
06 · Access & Audit Role-Based + Verified

Role-Based Team Access & Dual Audit Trail

Assign Viewer, Operator, Admin, or Owner permissions with two-factor authentication and IP allowlists. Every action is recorded in both your tamper-evident cloud audit log and a local log on the server.

Session Governance: Browser terminals authenticate per organization role and isolate interactive sessions per server.
Dual Audit Log: Your cloud audit log links each entry in order with one-click CSV export, while the agent writes a local audit.jsonl receipt file on your server.
Interactive Verification Summary

How each protection boundary works in practice

Command Safety Evaluation

Automatic safety rules + human sign-off

Before a command ever reaches a shell, RasnuOS checks for disguised scripts and evaluates destructive patterns across Linux, macOS, and Windows. Catastrophic commands are refused outright; service or config changes pause for your approval.

On-Server & Cloud Safety Verification Enforced before execution
Read-only inspection (df -h, systemctl status) Runs immediately
Config edit or service restart (systemctl reload nginx) Pauses for approval + .bak backup
Destructive system wipe (rm -rf /, mkfs) Blocked automatically
Data Minimization & Privacy

Data Boundary: What We Store vs. What We Never Touch

Diagnostic context is scrubbed of passwords and secrets on your server before transport and is never used to train AI models.

Stored in Control Plane

  • ✓ Server metadata, 15-second resource metrics, and service health status
  • ✓ Masked chat diagnostics, file diffs, and remembered server settings
  • ✓ Tamper-evident audit log entries (who approved, role, command, exit code)

Never Stored

  • × Full server disks or files outside snippets explicitly inspected in chat
  • × Plaintext root SSH keys or unhashed agent authentication tokens
  • × Server-to-server migration payloads (streamed directly host-to-host)
Active workspace logs retained for workspace life; purged within 30 days of deletion.
Privacy Policy [email protected]
Coordinated Disclosure · 48h SLA

Responsible Vulnerability Reporting

Found a security issue in the control plane or open-source agent? Report it directly to our engineering security desk under full Safe Harbor protection.

Security Desk
[email protected]
/.well-known/security.txt →
  • 48-Hour Acknowledgment: Every valid report is acknowledged within 48 hours with a dedicated triage lead.
  • Good-Faith Safe Harbor: We never pursue legal action against researchers following our security.txt policy.
Need vendor security questionnaires? Contact Security Team →

Ready to manage your servers in plain language?

Start free with 1 server and $5.00 in welcome credit. Connect your server in 30 seconds and run your first safe health check right away.

1. Create your free account (1 server + $5.00 usage credit included immediately).
2. Paste the one-line install command on your Linux, macOS, or Windows server.
3. Ask any question in plain language or open a live browser terminal.
No credit card required Prepaid wallet prevents surprise bills Cancel or switch plans anytime