Security review

This page is for whoever reviews Infrared for a security team. It answers the questions that review asks, in the order it usually asks them, and links the page that holds the detail. What isn't built yet is listed at the end, plainly. To go through it with the people who built it, book a call.

Where it runs

Infrared runs on a Kubernetes cluster you choose, the management cluster: its operator, API, web app, MCP server and Argo CD. Agent steps run as short-lived Jobs on that cluster. Your Products run in zones on it, or on workload clusters in your own clouds. See Architecture.

	Self-hosted	Hosted by Darkshift
The control plane	Your GKE or EKS cluster, in your account and region	Darkshift's cluster in Google Cloud, us-central1
Agent steps	Jobs on your cluster	Jobs on node pools of their own, sandboxed under GKE Sandbox
Your Products	Your clusters	The hosted cluster, or clusters in your own cloud accounts
Who holds the platform admin role	You	Darkshift; your org admins hold your org

On the hosted environments every org is fenced from every other: by network policy, by quotas, by its own registry user, by an Argo CD project as narrow as the platform's, and by GKE Sandbox under its apps and agent steps.

Where your code and prompts go

What	Where it goes
Your repos	Your GitHub organization, through a GitHub App with no personal token, or Gitea on the management cluster
Prompts, with your code in them	The model provider your org chose, on your org's own account: the Anthropic API, with your org's own key. Darkshift never sees your code through a key of its own
Builds and images	Built on your cluster; kept in the install's own registry
Infrared's records: runs, verdicts, evidence, approvals, deployments	Custom resources and Postgres on the management cluster
Backups	One encrypted artifact per backup, in your bucket, encrypted to recipients only you hold. See Backups
Telemetry to Darkshift	Only where the install's telemetry is on: counts and operational metrics, never prompts, code, diffs, names, emails or secrets. Four switches turn it off. See Install telemetry

Nothing else leaves a self-hosted install for Darkshift: no version check and no crash reporting, and the license is checked offline.

How an agent step is contained

Each AgentRole step is one Kubernetes Job in the org's namespace, with two containers:

• The runner holds the step's credentials: a forge token limited to what the AgentRole may do, and the org's model credential. It fetches the repo, hands the agent a workspace, checks what comes back, and writes to the forge.
• The agent runs in a container of its own, as its own user, with no secret in its environment and no shared process namespace. It reaches the model only through the runner's model proxy, with a key that opens that proxy and nothing else.

A NetworkPolicy fences every step's pod: DNS and HTTP(S) to the internet for the model provider and the forge, and nothing inside the cluster or its network, the Kubernetes API and cloud metadata included. The agent's memory is capped; a step that runs out says so and opens an incident.

Before the runner commits anything an agent wrote, it checks the workspace (from 0.1.5):

• Guard files. A change to, or deletion of, a tracked file under .claude/, or .infrared/'s manifest, bin/ or scripts/, fails the step and commits nothing, so an agent can't weaken the guards on its own branch.
• Secrets. A file holding a secret the runner knows, or a token shape that wasn't in it when it was fetched, fails the step. The step's result names the file, never the secret.
• Reviewers can't be steered. When a Change edits CLAUDE.md, AGENTS.md or CONTRIBUTING.md, a review step follows the default branch's copies and judges the Change's as part of the change under review.

Steps no one can skip

In the Change AgentWorkflow, the builder, the security review, the end-to-end verification, a person's approval and the merge are required, and a required step can't be switched off. A blocking verdict stops the Change, whoever wrote it. Human approval can never be removed: it is the step Infrared exists to guarantee. Production waits for a person too. See AgentWorkflows and AgentRoles.

Each AgentRole's guidance is written as your org's opinions, which your platform team edits, switches off or adds to. Every AgentWorkflow has a weekly budget and a circuit breaker. See Models and costs.

Who can do what

• Sign-in is through Google or GitHub, with your own OAuth client on a self-hosted install. See Sign-in.
• Roles follow your Google Workspace groups and GitHub teams through access groups, within minutes, and Infrared fails closed when it can't read them. See Access groups.
• Break glass is a root user whose password lives in your vault, never in Infrared; the record keeps only its bcrypt hash, and every use is recorded. See Break glass.
• API tokens are kept only as SHA-256 hashes. See API tokens.
• Clouds are reached through Workload Identity on Google Cloud and IAM roles on AWS. Infrared stores no cloud keys. See Cloud accounts.
• The MCP server gives tools such as Claude Code read access to runs, deployments, incidents and SLOs, with no write path.

Where each secret lives is in Architecture.

The record

Every run, verdict, piece of evidence, merge, approval, deployment, promotion and rollback is in one log on Changes, with who did it, what the agent saw, what it cost and what it captured. Everything Infrared changes in your platform is a pull request to your gitops repo, Infrared's own upgrades included. See Follow a Change and Upgrades.

Not built yet

What	Where it stands
SOC 2	Not started. Design partners decide where it falls on the roadmap.
An air-gapped install	Not built. An install needs the model provider and the forge over the internet.
Models in your own account	Claude through Amazon Bedrock in your own AWS account is being built for the 0.2 track.
Infrared's own secrets in a secrets manager	The gitops template installs Infisical and external-secrets, but Infrared's own secrets are Kubernetes Secrets today.
A third-party penetration test	Not yet done.

Questions this page doesn't answer: book a call, or write to [email protected].