Security model

This page is the contract for Ship / Dock / Keel: and for how you are allowed to test it.

Legitimate use only. Do not abuse. Buraaq administration cooperates with lawful agency requests.

Use

Test on hosts you own or have written permission to use. Do not scan, flood, or break into Dock (:7422), Keel (:8080 / :8443), or anyone else's network. Do not ship malware. Do not treat Dock as a sandbox for untrusted tenants.

Agencies with a lawful request: contact Asim. We respond in good faith. We do not publish exploit recipes.

Integrity

Every .bur is SHA-256 hashed over the archive. A digest mismatch is a hard error.
Paths inside a ship cannot contain .., \, or a leading /.
App names are identifiers: [A-Za-z_][A-Za-z0-9_-]*.

Dock auth

Mutations require a bearer token (constant-time compare).
Default bind is localhost. --public is a conscious choice.
Control plane is HTTP + token. Put TLS in front if 7422 faces the network.

Isolation

Dock isolation is a private directory and a child process, not a VM, not a Linux container, not multi-tenant kernel isolation. Do not park untrusted customers on one dock and call it a sandbox.

App TLS

Users hit Keel:

HTTP 8080
TLS 8443

That is independent of dock HTTP. Keep serving TLS for browsers even when dock stays on loopback.

Secrets

Postgres credentials stay on the host environment (BURAAQ_DATABASE_URL), not inside the ship, unless you packed them on purpose. Never commit tokens or database URLs. Rotate anything that leaked.

Language safety

Safe Buraaq is memory-safe by default (GFA). unsafe is the only gate for raw pointers and unchecked FFI. That does not replace firewalls, tokens, or host hygiene.

Hash checks are not permission. If you did not get an invitation to a host, you do not test that host.