Radical Transparency

Security at WireZTNA

We believe that trust is earned through transparency. Here you'll find our vulnerability disclosure policy, the security standards we follow, and a clear view of how your data flows through our architecture.

Vulnerability Disclosure Policy

How to report a security issue responsibly

We take the security of WireZTNA and our partners' data seriously. If you've discovered a vulnerability in our platform, we want to hear from you and will work with you to resolve it quickly.

How to report

Send your findings to:

security@wireztna.com

PGP key available at /.well-known/security.txt

What we commit to

  • Acknowledge your report within 48 hours
  • Provide an initial assessment within 5 business days
  • Keep you informed throughout the resolution process
  • Credit you publicly (if you wish) once the fix is deployed
  • Not pursue legal action against good-faith reporters

Scope

In scope

  • • Control Plane API (*.wireztna.com)
  • • Web Admin Panel
  • • Client applications (Go, Android, iOS)
  • • Publisher agent binary
  • • WireGuard tunnel configuration
  • • Broker reconciliation logic

Out of scope

  • • Social engineering of staff
  • • DoS/DDoS attacks
  • • Third-party services (Cloudflare, AWS)
  • • Findings from automated scans without PoC

OWASP ASVS Compliance

Application Security Verification Standard — Level 2

WireZTNA's architecture is designed following the OWASP Application Security Verification Standard (ASVS) v4.0 at Level 2 — the recommended level for applications that handle sensitive data and require defense against the majority of application security risks.

L2

Level 2 — Standard

Suitable for applications handling business-critical data

Level 2 covers most applications and APIs that process significant or sensitive data. It ensures defenses against the majority of risks found in modern software today.

Key areas covered

V1

Architecture & Threat Modeling

Zero Trust design with per-user policy enforcement

V2

Authentication

OTP email + TOTP MFA, JWT with short-lived tokens

V3

Session Management

Ephemeral PSK sessions with configurable TTL (auto-expiry)

V4

Access Control

Role-based (admin/user), group-based resource access, nftables enforcement

V6

Cryptography

WireGuard (Curve25519, ChaCha20-Poly1305, BLAKE2s)

V7

Error Handling & Logging

Full audit trail, structured logging, no sensitive data in errors

V8

Data Protection

Private keys never leave the device, no plaintext secrets at rest

V9

Communications

All data-plane traffic encrypted end-to-end via WireGuard tunnels

We are working towards full Level 2 compliance. Areas currently under improvement include formal penetration testing by an external auditor and automated DAST integration in our CI pipeline. If you're an MSP evaluating our security posture, contact us for a detailed compliance matrix.

Architecture & Encryption

End-to-end encrypted data plane with minimal metadata

END-TO-END ENCRYPTED DATA PLANE (WireGuard) Client Private key never leaves device Broker Routes only — cannot decrypt payload Publisher Delivers to private network 🔒 🔒 CONTROL PLANE (metadata only) User identity & group membership Public keys (never private keys) Session timestamps & TTL Connection metadata (IP, handshake age)

What we store vs. what we don't

Stored in the control plane

  • • User email and display name
  • • Group membership and access policies
  • • WireGuard public keys
  • • Session metadata (created, expires, overlay IP)
  • • Publisher endpoints and exposed CIDRs
  • • Audit logs (who did what, when)

Never stored or accessible

  • • WireGuard private keys (generated on-device)
  • • Payload content (traffic is opaque to the broker)
  • • Passwords in cleartext (bcrypt hashed)
  • • DNS query contents (proxy does not log queries)
  • • File or application data traversing the tunnel

Cryptographic primitives

Layer Algorithm Purpose
Key exchange Curve25519 (ECDH) Peer authentication and shared secret derivation
Symmetric encryption ChaCha20-Poly1305 Tunnel payload encryption + authentication
Hashing BLAKE2s Key derivation and MAC within Noise protocol
Session rotation Pre-shared Key (PSK) Ephemeral per-session PSK, rotated on TTL expiry
Password storage bcrypt (cost 12) User password hashing at rest

WireGuard's Noise protocol framework (IKpsk2 pattern) provides forward secrecy, identity hiding, and resistance to key-compromise impersonation. The broker never holds private keys — it only routes encrypted WireGuard packets between peers using kernel-level nftables and policy routing.

Questions about our security posture?

We're happy to discuss our architecture in depth with prospective partners. Request a detailed security assessment or schedule a technical review call.