Security
Security
Polaris is self-hosted. Users, sessions and credentials live in your database, and the code that handles them is a dependency you can read. This page collects what a review of that code starts from.
Threat model
Every control in Polaris answers a named threat. The threat-to-control matrix from the design documentation:
| Threat | Primary control(s) |
|---|---|
| Credential stuffing / brute force | rate limiting, lockout, breached-password check, MFA |
| Phishing / password reuse | MFA (TOTP/SMS/email), step-up on sensitive ops |
| Token theft (access) | short TTL, audience pinning, optional jti denylist, cookie mode |
| Token theft (refresh) | rotation + reuse detection (revoke family), hashed at rest |
| User enumeration | generic responses, timing equalization |
| OTP brute force | 6-digit + 5 attempts + 5-min expiry + per-account verify limit |
| OTP bombing (cost/abuse) | per-destination send limits + resend cooldown |
| Privilege escalation | can’t grant roles you lack; last-owner & hierarchy policies; org-scope checks |
| Cross-tenant access | path-org vs token-org consistency check; superadmin explicit |
| Account takeover via reset | hashed single-use tokens, 1h expiry, logout-all on reset |
| Session fixation | new tokens minted on every auth; refresh rotates |
| Replay (TOTP within window) | last-accepted step tracking per factor |
| Key compromise | asymmetric signing, key rotation via kid/JWKS, fail-fast on missing keys |
| Insider/abuse | append-only audit log, alertable events |
Read the full threat model: cryptography, key management, token security, rate limiting and the audit log.
Audit history
Two security audit rounds were remediated before the 1.0 release of the module the
polaris/* packages were extracted from. From the changelog:
Two security audits (#44 sign-off and the #97 follow-ups) fully remediated: atomic rotation/OTP/recovery claims, APP_KEY minimum length, full-length key fingerprints, typed challenge purposes, abuse caps.
Supported versions
| Product | Packages | Supported |
|---|---|---|
| Polaris for PHP | polaris/* | 0.1.x |
| Polaris for Univeros | univeros/polaris | 2.x (1.x keeps working on its own branch) |
Review status
External security review: scheduled before 1.0.0. Polaris for PHP is 0.1.0; 1.0.0 is tagged after the review (roadmap).
Advisories
Security advisories are published on GitHub:
univeros/polaris-core
for the polaris/* packages and
univeros/polaris for the Univeros module.
This site
This site loads Google Analytics (gtag.js), which sets cookies, and Google Fonts. The documentation search runs in the browser without a server.
Rendered from univeros/polaris-core at v0.1.0 · View source