Network access is infrastructure. Treat it like infrastructure.
SkiMasque is pre-1.0 and has not had an independent security review. It should not yet be the only control in front of production infrastructure. What follows states what is documented today; what is not built is marked Planned.
Service architecture
The control plane holds identity, the policy workflow, the fleet view and the audit trail. It is never on the traffic path: gateways enforce, and the control plane is authoritative only for desired state. In SkiMasque Cloud, SkiMasque operates the control plane; when you self-host, you do.
Availability
A gateway that loses its control plane keeps enforcing the last policy it cached. It reports itself degraded after a soft lease (15 minutes by default) and escalates after a hard TTL (30 minutes by default), and it never fails open. A control-plane outage is designed to degrade management, not enforcement.
PLANNED no availability commitments yet
Published availability targets and service-level agreements are planned.
Gateway health
A control-plane gateway reports health and usage counters by heartbeat, every 30 seconds by default. The control plane shows the desired-versus-actual fleet view and marks a gateway offline when its heartbeats lapse. A gateway can also expose health, readiness and metrics endpoints for your own monitoring.
PLANNED live status reporting is not available yet
A public live status view of SkiMasque Cloud is planned.
Session handling
- Access is denied unless a policy rule explicitly allows it.
- Managed CI/developer credentials default to 15 minutes and are capped at 1 hour; standalone gateway credentials default to 1 hour. Clients refresh supported credentials. Agent sessions default to 30 minutes and are capped at 4 hours or a lower organisation limit. A copied bearer token can be used until expiry or applicable revocation; policy max_duration is not an enforced gateway timeout.
- Set agent-session TTL and per-kind organisation ceilings to bound credential lifetime. Policy max_duration currently provides metadata only.
- Credentials are bearer tokens: a token stolen from a running job grants that job's access for its lifetime, bounded by that job's policy.
Auditability
Each access decision is recorded, and every denial is logged with a reason. A gateway can write one JSON line per decision. A control-plane deployment ingests each gateway's hash-chained decision stream, rejects a break in the chain, and exposes fleet history and per-organization usage.
PLANNED advanced audit and search are still being built
Advanced audit search is planned.
Operational boundaries
- The control plane is not on the traffic path and cannot open or redirect a tunnel.
- The gateway trusts the issuer's signing keys and the organization's public key. It does not trust the client's claimed application, the destination, or a credential it cannot verify.
- In the fully managed deployment, organizations share the SkiMasque endpoint but are isolated from each other's traffic and policy.
- Your firewall remains the outer boundary: it decides what a gateway can reach at all.
Security reporting
Report suspected vulnerabilities privately, not in a public issue. The repository's security policy describes a GitHub private security advisory for this.
Report a vulnerabilityRead the security policy
PLANNED no dedicated mailbox yet
A dedicated security reporting mailbox is planned.
Incident response
The security policy describes how reported vulnerabilities are handled: fixes are developed privately, disclosure is coordinated, and a release ships with a security advisory. It also lists the steps operators should take if active exploitation is suspected.
PLANNED no operational process published yet
A published incident-response process for SkiMasque Cloud is planned.
Data handling
- Traffic between a workload and a gateway is carried over QUIC with TLS 1.3, always on.
- Past the gateway, traffic is plaintext by nature of a proxy unless the destination speaks its own TLS: the private destination sees the gateway's address.
- The control plane stores identity, policy revisions, audit history and usage for your organization.
PLANNED no formal data-handling documents yet
Formal data-handling documents, such as retention and subprocessor details, are planned.
Customer responsibility
SkiMasque does not bypass your network controls, and an over-broad policy silently widens access. The responsibility model:
SKIMASQUE
- Control plane (in SkiMasque Cloud)
- Platform
- Managed gateways (in the fully managed deployment)
CUSTOMER
- Policies
- Destinations
- Firewall
- Customer gateways
- Identity configuration
When you self-host, you also operate the control plane and everything it depends on.