Security

Security

Search is where tenant data leaks if the filter is forgotten, and an index operation is only trustworthy if it can be checked afterwards. This page collects what a review of Orion starts from.

Tenancy

From the monorepo README:

Tenancy is a choice with no default. Tenancy::single() is one tenant. Tenancy::resolvedBy($resolver) shares each index between tenants: every index then declares an org_key, the searcher filters on the current tenant beneath every query (the escape hatch included), and outbox writes are recorded under the tenant’s ids with the org key stamped, so no query returns, overwrites or deletes another tenant’s document. orion-search/polaris resolves the tenant from the Polaris token’s active organization.

Read the tenancy model and orion-search/polaris.

Receipts

Every apply and reindex issues a receipt signed with Ed25519 under a key id, in an append-only, hash-chained table. orion verify walks the chain and checks every signature; an auditor verifies with public keys only. The receipt signer, in the revision.

Review history

Each work package from WP1 to WP11 went through a security review, from WP2 on beside a code review. The decisions taken after each one, from the decisions log:

  • 2026-10-25 · WP1 · Declarative input is bounded and grammatical, after the security review.
  • 2026-10-25 · WP1 · The storage contract is tightened, after the security review.
  • 2026-10-25 · WP2 · Hardening after the WP2 code and security reviews.
  • 2026-10-26 · WP3 · Hardening after the WP3 code and security reviews.
  • 2026-10-26 · WP4 · Hardening after the WP4 code and security reviews, each fix test-first and the race fixes mutation-checked.
  • 2026-10-26 · WP5 · Hardening after the WP5 code and security reviews, each test-first.
  • 2026-10-26 · WP6 · Hardening after the WP6 code and security reviews, each fix test-first and the key ones mutation-checked (dropping the injected filter, dropping id qualification and post-filtering the k-NN leg each fail the isolation case).
  • 2026-10-26 · WP7 · Hardening after the WP7 code and security reviews, each fix test-first and the guards mutation-checked.
  • 2026-10-26 · WP8 · Hardening after the WP8 code and security reviews, each fix test-first, the tenant invariant mutation-checked (dropping the injected filter fails the fixture cases and the isolation case).
  • 2026-10-27 · WP9 · Hardening after the WP9 code and security reviews (no critical or high findings; live bypasses on three engines found no cross-tenant path).
  • 2026-10-27 · WP10 · Hardening after the WP10 code and security reviews.
  • 2026-10-27 · WP11 · Hardening after the WP11 code and security reviews.

Read the decisions log

Supported versions

Product Packages Supported
Orion orion-search/* 1.0.x
The Univeros module univeros/orion 1.0.x

Advisories

Security advisories for every package, the Univeros module included, are published on GitHub: univeros/orion.

This site

This site loads Google Analytics (gtag.js), which sets cookies, and Google Fonts. The documentation search runs in the browser without a server.

Rendered from univeros/orion at v1.0.0 · View source