Security model

The listener

• Local mode binds loopback only, rejects a non-local Host or Origin, and exits when the last client disconnects.
• Cluster mode listens on the configured address and accepts browser requests only from its public URL.

Authentication

Local mode authenticates every route and both WebSockets with the token minted for that run. Cluster mode uses OIDC or an authenticated proxy and maps groups to viewer, editor and admin roles. Anonymous administration is available only through an explicit unsafe opt-in.

Cluster access

Local mode references kubeconfigs in place and never merges them into a file it manages.

Cluster mode's chart runs from a read-only service account with no access to Secrets and no right to impersonate. Turn on impersonation for named users and groups, and Spinoza acts as the signed-in account, so Kubernetes RBAC decides what that person may do. The chart never grants impersonation of service accounts.

With impersonation on, shared tables and search are scoped to namespaces the account may list, and open feeds recheck that access. Views that need a whole-cluster answer require whole-cluster read access. An answer the cluster refuses to give counts as no.

What is recorded

Every change Spinoza makes is kept with who asked for it and whether the cluster allowed it. In cluster mode, sign-ins and refused roles join the trail, each entry is also a structured log line, and admins export it.

Terminal transcripts are off by default. Turned on, they hold whatever somebody typed, secrets included, and only admins read them.

Outbound traffic

• The apiserver, chart repositories and OCI registries you configured.
• In cluster mode, the identity provider you configured.
• The audit webhook, if you set one.
• In local mode, one optional update check per run. Cluster mode makes no update check.

The artifacts

Archives, desktop apps, the container image, Helm chart and SBOMs carry build provenance. The local installers verify checksums before they write anything.