AI Connect/Reference/Security

Security

Ask AI about Vinkius

The security model of @vinkius/connect: one server-side secret, write-only credentials, no runtime tokens in your application, redacted observability, and the vulnerability disclosure policy.

@vinkius/connect is designed to minimize the secret surface an integrator has to manage. This page is the model, the guarantees, and the disclosure policy.

One secret only

The SDK is initialized with a public application id (vk_app_*) and a single secret application key (vk_app_sk_*). The secret is sent only as an Authorization: Bearer header over HTTPS.

Identity on every request. Each call carries your vk_app_* app id and is validated against the key server-side: a key can only ever act for its own application. A leaked vk_app_sk_* is scoped to a single application; the API rejects cross-tenant access with a 404.
Keep it server-side. An environment variable or your secrets manager. Never ship it to a browser, mobile app, or any client the user controls.

The runtime token never reaches the SDK

Tool execution is proxied by the Vinkius API. The internal data-plane token (vk_live_*) is created, rotated, and used entirely server-side. There is no runtime secret for your application to store or leak. Every call through the runtime endpoint is metered and revocable (kill switch).

Credentials are write-only

End-user credentials are stored through the API and never returned. The SDK can only report which keys are configured, never their values, and the model never receives raw secrets:

typescript

const state = await github.credentials.status();
// state.configured: Record<string, boolean> — flags, not values

Zero runtime dependencies

The core ships with no third-party runtime dependencies, keeping the supply-chain surface minimal.

Redaction by default

Observability hooks receive redacted headers and bodies. Authorization, tokens, and credential-like fields never reach a logger through the SDK. Redaction matches a fixed list of exact, case-insensitive field names (authorization, token, api_key, credentials, password, secret, client_secret, and others) to a maximum depth of six. See the API Reference for the full lists.

Transport safety

Non-localhost http:// base URLs emit a console warning; always use https:// in production.

Report a vulnerability

Report security issues privately to security@vinkius.com. Do not open public issues for vulnerabilities. Reports are acknowledged within 3 business days and receive a remediation timeline after triage.

Supported versions

Pre-1.0 releases receive security fixes on the latest minor version. Keep @vinkius/connect current:

bash

npm install @vinkius/connect@latest