> ## Documentation Index
> Fetch the complete documentation index at: https://docs.usedino.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

> How Dino handles your data, protects your infrastructure, and earns your trust.

## Dino runs locally

Your API data stays on your machine. The Dino CLI is a local process that connects to your API endpoint, runs tests, and writes results to your filesystem. No data is sent to Dino servers.

The only external call is the **optional** AI reasoning feature, which calls the Anthropic API. Even then, all responses are stripped of secrets before they are sent.

## No secrets in config

`.dino.yml` ever contain API keys or tokens. Only environment variable names are referenced.

```yaml theme={null}
# This is what Dino writes:
auth:
  enabled: true

# Your token lives in the environment:
# export DINO_API_TOKEN="your-token"
```

This is enforced by design (INV-1), and  the `buildConfigYaml` function is verified to reject any input containing key material.

## LLM Redaction

When AI reasoning is enabled, all API responses are stripped of sensitive data before being sent to the LLM provider:

* API keys and tokens
* Bearer tokens and JWTs
* Connection strings
* Credentials in any format

The redaction layer runs automatically. You don't configure it - it's always on when AI features are used.

## SSRF Protection

Dino validates every endpoint before connecting. The SSRF guard blocks:

| Range            | What it blocks                                   |
| ---------------- | ------------------------------------------------ |
| Private networks | `10.x.x.x`, `172.16-31.x.x`, `192.168.x.x`       |
| Loopback         | `127.x.x.x`, `::1`                               |
| Link-local       | `169.254.x.x`, `fe80::`                          |
| TEST-NET         | `192.0.2.x`, `198.51.100.x`, `203.0.113.x`       |
| Class E          | `240.x.x.x+`                                     |
| DNS rebinding    | Runtime DNS validation before every HTTP request |

We found and fixed 7 SSRF vulnerabilities in our own security audit (issues #855-#859, #871, #874). The fixes include IP range blocking, DNS rebinding prevention, and runtime DNS validation on every outbound request.

## Supply Chain Security

| Check                  | What it does                                                                                                               |
| ---------------------- | -------------------------------------------------------------------------------------------------------------------------- |
| npm publish (gated CI) | Release workflow from private repo; SBOM + verify gates (npm Sigstore provenance omitted — requires public Actions source) |
| Aikido Security        | Automated vulnerability scanning on every PR                                                                               |
| eslint-plugin-security | Static analysis for common security patterns                                                                               |
| SBOM generation        | Software bill of materials via CycloneDX                                                                                   |
| npm audit              | Dependency vulnerability check in CI                                                                                       |
| SonarQube              | Custom quality gate with 395+ rules                                                                                        |
| Secrets scanning       | Automated detection of leaked credentials                                                                                  |

## Executable Configs Blocked

Only YAML and JSON config files are loaded. `.js`, `.ts`, `.cjs`, `.mjs` Configs are rejected. This prevents code injection via supply-chain attacks on the config file.

## Tenant Isolation

Multi-tenant architecture with strict boundaries:

* Each tenant has its own config file (`tenants/<id>.yml`)
* No cross-tenant data access
* Tenant credentials never appear in shared config or output
* Scan results are scoped to the requesting tenant

## CI Security

13 automated checks run on every PR:

* Enforcement integrity verification (HMAC-SHA256 checksums)
* Protected file gate (CODEOWNERS-enforced)
* Secrets scanning
* SonarQube analysis with custom quality gate
* Dependency audit

<Info>
  See [Compliance](/security/compliance) for our SOC 2 and GDPR posture.
</Info>