Skip to content
Spinoza

Security posture

Two modes, two trust boundaries.

Spinoza runs locally with your kubeconfigs, or inside one cluster for a team. Each mode has its own trust boundary.

  1. Local mode stays local. It refuses a non-loopback bind, rejects non-local Host and Origin, and exits when the last client disconnects.

  2. Authentication is explicit. Local mode uses a token minted for that run. Cluster mode uses your OIDC provider or an authenticated proxy; anonymous administration needs an explicit unsafe opt-in.

  3. Kubernetes makes the final call. In cluster mode, Spinoza impersonates the signed-in account and the apiserver applies that account's RBAC.

  4. Shared reads are scoped. Tables and search show the namespaces the signed-in account may list. Cluster-wide views require cluster-wide read access.

  5. Kubeconfigs stay in place. Local mode references them where they are, re-reads them and never merges them into a managed file.

  6. Release provenance is published. Archives, desktop apps, the container image, Helm chart and SBOMs carry build provenance. The installer verifies checksums before it writes anything.