Security model

Deployment

policy · not checkedone private deployment — no shared multi-tenant SaaS tenant

Per-object ownership

policy · not checkedno second tenant exists to reach; per-object ownership checks inside the deployment are not regression-tested

GDPR data-residency

policy · not checkedsingle jurisdiction, no cross-border transfer

The live, API-declared version of this claim is in Compliance posture above.

Production secrets

policy · not checkedroot-only, write-protected file outside the repository; passcodes stored as hashes only

Host configuration — not observable from this page.

Tank is invite-only. Accounts are created only with a valid invite code.

Registration gate

regression-testedPOST /v1/auth/register rejects a missing or wrong invite code with 403; constant-time comparison; closed entirely when no code is configured

Asserted by test_register_with_invalid_invite_code. Not probed from this page — probing it would mean attempting a registration.

Password storage

regression-testedPBKDF2-SHA256, 260,000 iterations, 16-byte random salt per password, constant-time verify

The scheme is asserted by test_local_auth_uses_pbkdf2. The iteration count and 12-character minimum are in code but not yet pinned by a test.

Tank exposes one read-only MCP tool, get_latest_spikes, at POST /v1/mcp/patent-watch. Every call needs a signed-in bearer token and counts against the shared run rate limit.

#2 Description witness

regression-testedthe tool description is pinned by SHA-256; a mismatch stops the API from starting

Asserted by test_verify_tool_witness_raises_on_mismatch.

#4 Principal allowlist

regression-testedconstant-time per-principal allowlist — currently in bootstrap mode (empty), so every signed-in account may call the tool

Bootstrap behaviour asserted by test_check_principal_allowed_bootstrap_mode.

#6 No raw subprocess

regression-testedan AST lint fails the build if MCP modules call subprocess, os.system, os.popen or os.exec*

Enforced by tests/test_no_raw_subprocess.py.

#5 No write tools

policy · not checkedthe tool list contains a single read-only tool; no write path is exposed

#1 #3 Reuse + transport

policy · not checkedwraps the existing HTTP payload builder; HTTP-only transport behind the same bearer-token gate

Output fencing

policy · not checkedtool output is wrapped in BEGIN/END TOOL OUTPUT markers so clients can treat it as data, not instructions

In code; no test asserts it yet.

MCP audit log

policy · not checkedoptional JSONL audit per call: hashed principal, tool, hashed arguments, latency, error flag

Writes only when the audit path is configured; whether it is enabled on this deploy is not visible here.

Lovable · April 2026

Reported publicly on 20 April 2026: between 3 February and 20 April 2026, chat history and source code of public Lovable projects could be read by any signed-in Lovable user who had the project link. Lovable's incident report

Adversa TrustFall · May 2026

Published 7 May 2026: one-click RCE in Claude Code, Gemini CLI, Cursor CLI and Copilot CLI. A cloned repository's project settings can auto-approve its own MCP servers, which then start as local processes as soon as the folder-trust prompt is accepted. Adversa's write-up

What Tank does about it

Tank narrows both surfaces rather than claiming immunity. One private deployment means there is no other customer's project to reach. The single MCP tool runs server-side over HTTP, never spawns a process, and sits behind the same token gate as the API. Neither measure protects a developer's own coding CLI, and per-object ownership checks inside the deployment are not yet regression-tested.