Documentation

Security and privacy

Moonwire is designed to be useful without source content, prompts, or model output. References and metadata can still be sensitive and must be minimized.

Implemented controls

• Project-scoped bearer authentication with salted Argon2id key hashes on current main.
• Composite database constraints and project-scoped queries for tenant isolation.
• Strict JSON decoding, a default 1 MiB body limit, and parameterized SQL.
• No fetching of user-supplied URLs in the core service.
• Structured logs that exclude authorization headers and request bodies.

Operator responsibilities

Terminate TLS, restrict network and database access, rotate keys, minimize metadata, configure retention outside Moonwire where required, and test backups.

Read before production use

• Security policy and responsible disclosure
• Threat model
• Hardening guide