Security & privacy

Every .parc capsule is a ZIP with a canonical-JSON manifest that lists each file with its size and SHA-256. The manifest is signed with Ed25519 at seal time by a key that lives in your repository's .patcharc/keys/ directory (mode 0600) and never leaves it.

patcharc verify checks path safety, a zip-bomb ratio cap, the manifest, the signature, and every per-file hash and size, offline, with no account. The trust model is explicit: a capsule proves what it contains and which key sealed it, nothing more.

When you share a capsule, the service runs an independent implementation of the same checks before anything is published. A capsule that fails verification is marked failed and is never served from an ArcLink.

The CLI includes a redaction engine with 13 built-in detectors (AWS, GitHub, Slack, Stripe, OpenAI, Anthropic, and Google keys, PEM private-key blocks, JWTs, connection strings), env-file rules, high-entropy scanning, forbidden paths, and custom regexes.

In 0.2.0 the engine is not applied automatically by patcharc stop. Capsules contain commit patches as Git produced them, the redaction report lists your configured rules with an empty applied list, and the manifest's trust block reports redaction_applied: false. Read a capsule with patcharc inspect and unzip before sharing it publicly. Wiring the engine into seal is the first item on the 0.3 list.

A provider key registered through the connections API is envelope-encrypted: the key is encrypted with a random per-connection AES-256-GCM data-encryption key, and that key is wrapped with a versioned master key held only by an isolated key service with no public endpoint.

Plaintext exists in the key service's memory for the duration of one resolution call. No API returns a key, and the public API never forwards keys anywhere else.

AI summaries are not generated in 0.2.0. When they are, managed model calls run with content logging disabled, and prompts are built only from a capsule you already chose to upload.

Authentication is bearer-token based. The CLI authenticates with a refresh token that is stored server-side as a SHA-256 hash, rotated on every use, and lives 90 days. Service-to-service tokens are signed with a one-hour expiry. The browser session on the approval page is an HttpOnly, Secure, SameSite cookie.

Every account-scoped query carries the account identifier, enforced at the middleware layer, so one account can never read another's capsules or shares. Rate limits are 30 requests per minute on authentication endpoints and 300 per minute elsewhere, keyed by user, then account, then IP.

Internal components that handle keys and verification have no public endpoints and are reachable only from the API. Failed background work is retained rather than dropped, so it surfaces instead of vanishing.