Cryptographic Audit & Architecture

Security & Cryptographic Architecture

This document provides a transparent, verifiable technical audit of the security controls, encryption algorithms, and isolation boundaries implemented in Kankali Context.

1. Stateless Zero-Custody Proxy Model

Unlike conventional AI memory SaaS solutions that store user data on central databases, Kankali is designed as a stateless cryptographic transport layer:

DATA FLOW & ISOLATION MAP:

[ Claude / Cursor / ChatGPT / Grok ]

│ (HTTPS / MCP JSON-RPC with HMAC Token)

▼

[ Kankali Stateless Edge Proxy (Vercel Serverless) ] ── (In-Memory Processing Only)

├──► [ Google Drive: spaces=appDataFolder ] (User's Private Account)

└──► [ GitHub Repository Vault ] (User's Private Repo)

0 Central File Storage: Markdown context files, SDLC documents, and project memories are written directly to your private Google Drive or GitHub repo.
0 Disk Persistence on Server: Vercel serverless functions process payloads in memory and terminate immediately after forwarding requests.

2. Cryptographic Standards & Implementation

AES-256-GCM

All stored credentials (such as GitHub PAT tokens) are encrypted with AES-256 in Galois/Counter Mode (GCM) using 96-bit random IVs and 128-bit authentication tags to prevent ciphertext tampering.

HMAC SHA-256

Master Auth Tokens (km_<expiresAt>...) and Two-Step Delete Confirmation tokens are cryptographically signed with HMAC SHA-256 with strictly enforced expiration timestamps.

OAuth 2.1 + PKCE

Implements Proof Key for Code Exchange (RFC 7636) with SHA-256 code challenge verification on dynamic client registrations and MCP endpoint authentication.

3. Minimal Scoped Permissions

Google Drive Scope: We request ONLY https://www.googleapis.com/auth/drive.appdata. This restricted scope allows Kankali to create and read files only inside a private hidden app directory. Kankali has ZERO access to your personal Google Drive files, Google Docs, or photos.
GitHub Token Scope: We require only repo permissions on the specific repository you designate as your vault.

4. Verify the Source Code

Security by obscurity is not security. Every algorithm, token verifier, and router is open source and available for independent security review:

Inspect lib/crypto.ts (AES-256-GCM) ↗Inspect lib/master-token.ts (HMAC Verification) ↗ Full Public Repository

← Back to Home Live Service Status →