Security features¶

CodeNavi is built to be self-hosted in a trusted network: the whole retrieval stack runs on hardware you own, a scanner reads every chunk before it is stored or handed to a model, and the supply chain is signed so you can verify what you installed. This page catalogs the security capabilities; the Security model explains how the scanner works in depth.

Defense in depth¶

Every path from your source to an answer runs through the same gate. The scanner sits between your code and the index, so a credential or an injected instruction is caught before it can be embedded, stored, or returned to an agent.

  Your disk    Your code — repositories stay on hardware you own;
               nothing is uploaded to index them
      |
  Parse        AST-aware chunking — functions and classes split on
               real boundaries across 15 languages
      |
  Gate         SECURITY SCANNER — reads every chunk before it goes
               anywhere. Secrets and PII become [REDACTED:rule_id];
               injected instructions are marked [FLAGGED:...].
               Tag-only dry-run or hard blocking mode.
      |
  Local        Embedder + index — the code-specialist model and your
               LanceDB index, both on your disk. Redacted values
               never reach either.
      |
  Access       MCP access gate — bearer-token auth, a startup
               exposure guard, tiered /health disclosure
      |
  Answer       Your agent — ranked chunks with file:line citations

Opt into a cloud LLM and it receives the same ranked chunks — never whole files. Zero telemetry from CodeNavi either way.

What ships¶

Secrets & PII redacted at chunk time

Rules span AWS, GitHub, Slack, Stripe, GCP, OpenAI, JWTs, database DSNs, PEM/private keys, Firebase, and generic credential patterns — plus PII on by default: payment cards (Luhn-validated) and IBANs (mod-97-validated), with an opt-in extended set (SSN, email, phone, public IP). A match becomes [REDACTED:rule_id] before the chunk is embedded, so it never enters the index, a search result, or a chat context.
Prompt & prose injection scanning

Instructions hidden in code comments, string literals, or documentation — a hostile README or PDF telling an agent to exfiltrate — are caught by dedicated rules plus prose heuristics and marked [FLAGGED:...], so your agent is told to ignore them rather than obey them.
Quarantine & allowlist

Flagged chunks land in a review queue, not silently in your index. Inspect each one in the Security screen and quarantine or allowlist it with a click — false positives are one action away, real hits stay contained. Every allowlist entry requires a reason and is timestamped.
Local-first, zero telemetry

Embedding, indexing, search, and reranking all run locally in a container you host — NVIDIA or AMD, including Instinct MI300, with identical index quality on either. No usage beacon, no account. The only network calls are ones you can see and switch off: an optional once-a-day update check (version number and license token, never code — disabled by deleting one file), and any cloud LLM you explicitly configure.
Signed & verifiable supply chain

Release images and update manifests are cosign-signed and verified fail-closed by the installer and updater; every release ships a CycloneDX SBOM, and models are pinned revisions with no remote model-code execution. Verify the signing-key fingerprint out of band — via codenavi.com/security, a different channel than the package — before you install. Details: Updating CodeNavi.
Access control at the door

The MCP server takes bearer-token auth, a startup exposure guard refuses to bind wide open by accident, and /health discloses in tiers — an unauthenticated probe learns liveness, not internals. Exposing the server beyond localhost is covered in Remote access.
Cloud LLMs stay optional

CodeNavi works fully offline. Enable Claude, OpenAI, or another provider for chat and the model receives ranked chunks with citations, never whole source files — and the choice is per install, with an explicit warning before any code leaves the box.
Inspect and control it

The Security screen shows scanner status, flips dry-run to blocking, browses every flagged chunk, manages quarantine and allowlist, and runs a scan tester against arbitrary text. The policy is yours to see and set.
Framework fit, GDPR to FedRAMP

Self-hosted with zero egress by default means the hard questionnaire rows answer themselves: no third-party recipient exists (GDPR), the data-flow diagram has no outbound arrow (SOC 2, ISO 27001), no PHI reaches the vendor (HIPAA), no cloud service to authorize (FedRAMP). See the framework-by-framework mapping.
OWASP compliance gap analysis

The bundled Claude Code plugin adds /codenavi:compliance: an evidence-linked review of your indexed code against OWASP ASVS 5.0 core, the OWASP Top 10 2025, or EU Cyber Resilience Act Annex I. Every verdict cites file:line; "not applicable" and "cannot check from code" are stated honestly — audit preparation, not a certification. See Compliance gap analysis.

Verify it yourself¶

Security you can't inspect is just a claim. CodeNavi is built so you can check the work — the architecture, threat model, and disclosure policy ship as SECURITY.md in every package.

Curl the gate — Verify the security posture turns the access-control claim into five requests and the status code each must return, including the exact header-spoofing bypass from a real 2026 MCP-server RCE.
Read the rules — the detection ruleset is data you can open, extend, and diff, not a black box.
Run the scan tester — paste any snippet into the Security screen and watch exactly what would be redacted or flagged.
Check the signature — compare the shipped cosign.pub against the fingerprints published at codenavi.com/security, on a separate channel, before installing.
Choose the posture — fresh installs run tag-only dry-run so you see hits without breakage; flip to blocking when you're ready.