Trust starts with the scanner
mipo is built for environments where every component must be auditable. The scanner is a stdlib-only Go binary with a signed release, it authenticates with its own client certificate, there is no auto-update channel, and nothing phones home.
Security properties
The scanner is a Go static binary using only the standard library — a tiny, auditable supply chain.
Release binaries are Ed25519-signed; the installer verifies the SHA-256 and signature and refuses to install on a mismatch. Build from source and sign with your own key if you prefer.
Scanners are deployed manually; there is no silent update channel to compromise.
mipo does not phone home; all data stays in your deployment.
Every scanner presents a per-scanner client certificate on a dedicated :8443 ingress. The private key is generated on the scanner host (the manager only signs a CSR); 30-day leaves renew automatically, revocation is enforced at the application layer, the issuing CA can be rolled over, and each scanner can additionally be bound to a source IP, CIDR, or ASN.
Path-based scopes such as /scans:execute with four built-in roles; external IdP via generic OIDC with optional local fallback.
TOTP second factor with recovery codes for local accounts, enforceable deployment-wide. Destructive, trust, and credential endpoints additionally require a fresh re-authentication within the last 10 minutes — even for the owner.
One enforced password policy drives the live checklist in every form and the API validation; 10 consecutive failures lock an account for 15 minutes.
Day-0 setup creates a local owner that bypasses scope checks (but not step-up); everything after is least-privilege.
HTTPS at the edge with ACME/Let’s Encrypt issuance from certificate profiles, reusable DNS credential sets, an auditable issuance-run history, and alarms on renewal failure.
Database backups can be AES-256-encrypted at rest. Restore is an explicit, destructive operation run with the operator CLI scripts/ops/restore.sh, which connects as the database owner; the setup-wizard restore exists only where the manager holds owner credentials (development stacks) and is unavailable in the production compose.
Every scan and DNS job ends with a receipt signed by the scanner that ran it, so "we scanned and nothing changed" is distinguishable from "we never scanned".
Audit events, scan results, job receipts, and DNS observations live in six tables no application role can update or delete; a database trigger blocks mutation even on a privileged path.
A global interceptor records every state change to an append-only, hash-chained log with a built-in integrity check.
What mipo does not do
- Not a goal No compliance guarantee — mipo collects evidence; auditors determine control satisfaction.
- Not a goal No auto-patching — mipo reports exposure, it does not remediate hosts.
- Not a goal No silent scanner updates — scanner upgrades are a deliberate, manual operator action.
mipo reports exposure and preserves evidence — it does not remediate hosts, patch software, or certify compliance.
Read the security model
A docs-style reference covers the supply chain, authentication, TLS, backups, and audit guarantees in detail.