Security of the Security Tool

A DLP agent runs with elevated trust on every protected workstation. Its own attack surface and failure modes matter as much as the threats it's designed to catch.

Compiled-core enforcement

Every piece of logic that decides to mask or block data — policy evaluation, detection, the masking/redaction engine — runs inside the compiled Go agent. No interpreted runtime sits in that decision path.

Dependency minimalism as attack-surface reduction

The repository as a whole declares five direct Go module dependencies: creack/pty, jackc/pgx/v5, golang.org/x/crypto, golang.org/x/sys, and golang.org/x/term. Scoped to what actually ships inside the workstation enforcement binary specifically, that's three: creack/pty (PTY handling), golang.org/x/sys (used for Linux fanotify kernel mediation), and golang.org/x/term. The other two — jackc/pgx/v5 (PostgreSQL driver) and golang.org/x/crypto (Argon2id credential hashing) — are control-plane-only and never compiled into the agent. For a binary that runs with elevated trust on every protected endpoint, a small, auditable dependency graph is a concrete, checkable security property. Adding a dependency to the enforcement core requires an architecture decision record. The Admin UI ships as vanilla JavaScript with no build step, which means the deployed control-plane server image carries no npm-based build toolchain as part of its own supply chain — relevant specifically for air-gapped and regulated deployments where the provenance of every artifact matters.

Policy tamper resistance

Covered in full in Policy Engine & Trust Chain: every policy snapshot is Ed25519-signed, verified through an ordered integrity chain before being trusted, anti-replay protected by a monotonic version high-water mark, and any integrity failure — a bad signature, an untrusted key, a structural mismatch — puts the agent into strict_fallback (fail-closed), halting enforcement immediately until a valid, current policy is restored.

Update integrity

Covered in full in Identity, Access & Fleet Operations: update artifacts are signed and verified before installation, applied atomically, and automatically rolled back on a failed post-update health check.

Continue to Compliance & Traceability Methodology.