MFA and password hashing
TOTP with authenticator apps and recovery codes. Passwords stored with Argon2id; legacy accounts migrated on first login. Tenant-level MFA policy can be enforced for all users.
✓ code-verified
Platform security
How Lunixar protects your fleet and your data
Lunixar is built so that access is verified, tenant isolation is total, and remote execution has explicit controls. MFA, Argon2id, content policy, trust tiers, and complete audit trail — with no exceptions in the critical layers.
Applies to backend, WebSocket, agent, and viewer. No exceptions to tenant isolation or RBAC.
Security layers
Identity, isolation, and execution control.
- Hardened authenticationTOTP MFA, Argon2id, brute force protection, and refresh token reuse detection.
- Full tenant isolationRBAC and tenant isolation verified across backend, WebSocket, agent, and viewer. No cross-tenant access.
- Controlled remote executionContent policy blocks download+execute for unverified tenants. Trust grants carry a time limit.
- MFA + Argon2idMandatory two-factor auth. Passwords hashed with Argon2id.
- Full isolationTenant isolated in backend, WebSocket, agent, and viewer.
- RBAC, no exceptionsPermissions verified on every endpoint. No operational bypass.
- Complete audit trailEvery blocked execution lands in script_logs with the exact reason.
Implemented controls
The security measures Lunixar applies today
Every control on this list is code-verified. No roadmap items or promised features here.
Session protection
Redis-backed brute force protection, refresh token reuse detection, and MFA step-up on high-risk actions. CSRF double-submit, security headers, and active sessions visible and revocable.
✓ code-verified
Tenant isolation and RBAC
Complete isolation across backend, WebSocket, agent, and viewer. RBAC on every endpoint — no cross-tenant access possible.
✓ code-verified
Remote execution policy
Tenants without verified trust cannot combine download and execution. Extended trust carries a 30-day TTL with a recorded reason. Network block rules also apply to registration, terminal, and scripts.
✓ code-verified
Agent and installer security
Obfuscated binaries with no .pdb files, auto-updates verified by SHA-256 and URL allowlist. Enroll tokens carry expiry and max-use limits.
✓ code-verified
Audit trail
Blocked executions land in script_logs with the exact reason. Trust-level changes carry timestamp, user, and reason.
✓ code-verified
3-layer security model
Identity, access, and execution
The three security layers apply in order. Without verified identity there is no access; without permissioned access there is no operation; without verified trust there is no sensitive remote execution.
01
Verified identity
Login protected with Argon2id, Redis-backed brute force protection, and TOTP MFA configurable as mandatory per tenant. Sensitive actions require a recent MFA step-up even when the session is active.
Session token + MFA step-up on critical actions
02
Segmented access
RBAC verifies permissions at every layer. Tenant isolation prevents any cross-account access. Every request to the backend, WebSocket, and viewer passes tenant and role validation.
No cross-tenant access in any layer
03
Controlled execution
Content policy blocks download-and-execute combinations for unverified tenants. Blocked destination rules apply to terminal, scripts, schedules, and account registration. Everything blocked lands in the audit log.
Blocked → IsMalicious=true → audited in script_logs
Security layers apply across backend, WebSocket, agent, and viewer. Tenant isolation and RBAC have no operational exceptions.
FAQ
Questions about platform security
What type of two-factor authentication does Lunixar support?chevron-down
How is it guaranteed that one tenant can't access another's data?chevron-down
What happens if a script tries to download and execute code from the internet?chevron-down
Can I see and revoke active sessions for my account?chevron-down
Ready to start
MFA, isolation, and audit trail from the first device
Security controls are active from the start of the trial. No additional configuration required — tenant isolation, MFA, and remote execution policy apply from the moment the account is created.
Get started