ENGINEERING ASSURANCE
Lira RDP Security engineering assurance
Security is treated as an engineering property of Lira: designed into tenant boundaries, agent communications, authentication, releases, and operational monitoring, then checked through repeatable tests.
Evidence reviewed 26 August 2026
Security assurance at a glance
- OWASP-guided internal testingApplicable risks and controls are evaluated using OWASP guidance.
- 502 passed502 backend security and regression tests passed; a separate disposable PostgreSQL RLS direct-login run also passed
- 6/6Signed Windows release artifacts for agent 2.7.31 were verified with Authenticode.
- Tenant isolationAPI authorization and database safeguards enforce organization boundaries.
- Agent-initiated channelThe normal agent channel initiates protected outbound HTTPS/WSS connections and requires no inbound management port. Optional WinRM is a separate diagnostic and recovery path.
Security assurance methodology
Vyvick performs internal application-security assessments using the OWASP Top 10 as a risk baseline and applicable OWASP Application Security Verification Standard guidance as a structured reference. Applicability is evaluated separately for the portal, API, Windows agent, Credential Provider, and production infrastructure.
These activities are internal self-assessments. They are not certification, endorsement, accreditation, or independent verification by OWASP. An ASVS version, verification level, independent penetration test, SOC 2 report, or ISO 27001 certification is not currently claimed.
OWASP Top 10 — official project · OWASP ASVS — official project
Assessment status
The table records evidence status. “Tested internally” means Vyvick ran repeatable tests for the stated scope; it is not independent certification and does not mean that every possible risk is eliminated.
| Area | Status | Verification evidence |
|---|
| Authentication | Tested internally | Password, MFA, replay protection, throttling, and account-recovery regression tests. |
|---|
| Session management | Tested internally | Secure cookies, CSRF controls, session versioning, revocation, and expiry behavior. |
|---|
| Access control | Tested internally | Organization, role, group, server-scope, ownership, and cross-tenant denial tests. |
|---|
| API security | Tested internally | Authorization guards, agent identity, input validation, rate limits, and error behavior. |
|---|
| Cryptographic controls | Implementation reviewed | TLS transport, password hashing and one-time token handling; passwords queued for local-user management operations are encrypted while pending and cleared after completion, failure or expiry. |
|---|
| Logging and monitoring | Tested internally | Audit records, event-ingest health, operational alerts, and security-event handling. |
|---|
| Agent security | Agent release verified | Outbound communications, scoped enrollment, signed release artifacts, and update verification. |
|---|
| Dependency exposure | Automated dependency audit | Frontend npm audit and backend pip-audit were reviewed on 26 August 2026 with no known dependency findings reported. |
|---|
Lira Agent Security Model
The agent is a privileged Windows service because it must read security events and apply explicitly authorized administrative actions.
- The agent initiates outbound HTTPS/WSS traffic; customer networks do not need an inbound agent-management port.
- Enrollment and routine communication use scoped agent identity and organization ownership checks.
- Release packages and the native Credential Provider are code-signed. Update packages are checked against published SHA-256 release metadata before installation.
- Windows/RDP passwords are not sent to or stored by the Vyvick portal. Credential validation remains on the Windows host.
- If the cloud service is unavailable, monitoring and remote commands pause; MFA availability follows the configured fail-open or fail-closed policy.
Authentication and Access Control
Identity and authorization are enforced at both session and object boundaries.
- Portal MFA, password throttling, one-time challenge consumption, and session revocation are tested.
- RBAC is combined with organization, group, server, and ownership scope checks.
- Agent enrollment and server identity checks prevent silent reassignment across customer workspaces.
- Sensitive administrative actions create audit records.
Encryption and Secrets
Cryptographic controls are applied to the specific data paths that require them.
- Public portal and agent communications use HTTPS/TLS.
- Passwords are stored using one-way password hashing; plaintext portal passwords are not retained.
- Platform secrets can be obtained through OpenBao, and production configuration fails closed when required key material is missing.
- Passwords queued for local-user management operations are encrypted while pending and cleared after completion, failure or expiry.
Tenant Isolation
Lira combines application authorization with database defense-in-depth for MSP and multi-customer operation.
- Each request resolves an organization scope before reading or changing customer resources.
- Role and server-access checks are applied to object-level API operations.
- PostgreSQL row-level safeguards complement application authorization; RLS is not the only tenant boundary.
- Changing an organization, server, or object identifier alone does not grant access to another customer's resources.
- Cross-tenant, empty-scope, inherited-group, and direct-server cases are covered by regression tests.
Secure Development and Operations
Security validation is part of routine development and release work.
- Backend regression tests cover authentication, authorization, tenant isolation, CSRF, secrets, agent identity, and remediation paths.
- Production frontend builds and authenticated browser route checks are performed before release acceptance.
- Frontend npm audit and backend pip-audit were reviewed on 26 August 2026 with no known dependency findings reported.
- Security findings are remediated and protected by regression tests where technically applicable.
Monitoring, Audit, and Response
Operational evidence supports investigation, accountability, and controlled recovery.
- Authentication outcomes, agent health, IP blocks, and security events are consolidated in the portal.
- Administrative changes and remotely executed actions create audit records with actor, target, result, and time context.
- Failed or delayed commands remain visible for diagnosis instead of being treated as completed.
- Security concerns can be reported through the documented support channel and investigated against retained operational evidence.
Verified engineering baseline — 26 August 2026
This dated engineering evidence is presented separately from the OWASP-guided self-assessment.
These are 502 Vyvick product security and regression test results. They are not OWASP ASVS controls, an OWASP assessment, certification, or an independent penetration test.
Evidence reviewed 26 August 2026
LIRA RDP✓PASSEDINTERNAL REVIEW
2026-08-26
502 passedBackend security and regression testsThe opt-in integration was excluded from this suite; a separate disposable PostgreSQL RLS direct-login run passed
6/6Release artifacts with verified Authenticode signaturesAgent 2.7.31: MSI installer, installation script, agent EXE/DLL, updater EXE and Credential Provider DLL
453Frontend dependency packages checkedKnown vulnerabilities found: 0
Internal, repository-backed verification; not an independent penetration test or certification.
MEASURED IN THE FIRST PILOT
Results from the first Lira pilot
Anonymized measurements from the first Lira pilot. They demonstrate real operating load without exposing customers, hosts, accounts or source addresses.
Security FAQ
Is Vyvick OWASP certified?
No. OWASP does not certify or endorse Vyvick. OWASP guidance is used in an internal application-security self-assessment process.
Has Lira completed an independent penetration test?
No independent penetration-test claim is currently published. When third-party assurance is completed, its scope and date will be stated explicitly.
Does the Lira agent require administrative privileges?
Yes. The Windows service needs privileges to read protected event logs and perform configured security and maintenance actions. Commands remain scoped and audited.
Does Lira store Windows or RDP passwords?
No. Windows/RDP passwords are not transmitted to or stored by the portal. Credential Provider processing and Windows validation remain on the protected host.
Can one customer access another customer's servers?
Tenant identifiers, object-level authorization, RBAC, ownership validation, and database row-level safeguards enforce customer boundaries.
What happens if Lira is temporarily unavailable?
Telemetry delivery and remote commands resume when connectivity returns. RDP MFA availability follows the organization's configured fail-open or fail-closed policy.
Report a security vulnerability
If you believe you have found a vulnerability affecting Vyvick or Lira, use the protected support channel and avoid public disclosure until we have had a reasonable opportunity to investigate and remediate it.
Return to the product overview →