Security Audit

Our About page says our security audit process is documented. Here is the document: what was audited, what it found, and how every finding got closed.

Scope

In February 2026, Odysseus was subject to a formal internal multi-tenant security audit covering 268 Go source files and 383 TypeScript files across 14 components — the control plane, the node agent, the dashboard, and every subsystem that touches tenant boundaries.

What it found

Source: docs/core/07-security.md:11 and audit/EXECUTION_PLAN.md:4,6,15.

How it was remediated

All 184 findings were closed through a single master execution plan, organized as six gated waves — Wave 0 (Emergency) through Wave 5 (Verify) — each unlocking the next only once its own gate passed. Work within a wave runs in parallel across components; work across waves is sequential, so a Wave 3 fix could not start before Wave 2's gate closed. The plan is explicit that later-wave findings could not be worked early even by someone with spare time: “DO NOT read ahead… and start working on later-phase items that belong to a future wave” (audit/EXECUTION_PLAN.md:78).

How it was verified

Nine dedicated security test suites exercise the post-remediation posture, each named for the failure class it guards against:

Suite	File
Authentication bypass	pkg/api/auth_bypass_test.go
Compliance verification	pkg/api/compliance_verification_test.go
Container isolation	pkg/api/container_isolation_test.go
Cross-tenant isolation	pkg/api/cross_tenant_isolation_test.go
Infrastructure isolation	pkg/api/infrastructure_isolation_test.go
Tenant isolation (general)	pkg/api/isolation_test.go
Performance regression	pkg/api/performance_regression_test.go
Role escalation	pkg/api/role_escalation_test.go
Tenant isolation (API-scoped)	pkg/api/tenant_isolation_test.go

Findings you can trace, not just count

Every finding carries an ID — CRIT-01, HIGH-04, and so on, scoped per component — and that ID appears again as a comment at the line that fixes it, so the claim “this was fixed” is checkable rather than asserted. For example:

• pkg/vault/approle.go:2 — // SECURITY FIX (CRIT-02): Per-tenant AppRole management replaces the shared…
• pkg/vault/approle.go:25 — // SECURITY FIX (HIGH-04): Namespace enables per-tenant Vault namespace isolation.
• pkg/api/container_ops.go:227,304,341,390,436 — five separate call sites, each carrying // SECURITY FIX (HIGH-02): Mandatory tenant ownership verification

The execution plan cross-references these same IDs across components when one fix depends on another — for instance Consul CRIT-01 (remove legacy) -> Vault CRIT-03 (tenant paths) -> Vault CRIT-01 (API scoping) -> Agent CRIT-02 (tenant ownership) (audit/EXECUTION_PLAN.md:143-144) — so the dependency chain that motivated the wave ordering is itself part of the public record, not a claim we're asking you to take on faith.

Status

Complete. All 184 findings remediated across all six waves; every gate closed (audit/EXECUTION_PLAN.md:6). This is not an ongoing remediation effort we are describing optimistically — it finished, and what you are reading is the closed record of it.

For what the resulting controls actually do day to day, see Security. For how the audit trail itself proves it hasn't been tampered with after the fact, see Compliance.