Skip to content

Security Posture

This document explains how DEXR Outpost handles credentials, what residual risks exist, and what steps you should take to reduce exposure. It is the authoritative reference for backup-exclusion guidance; the GUI config view and the dexr-outpost init completion message both link here.

Plaintext at Rest

DEXR Outpost stores DEXR_WRITER_KEY, DEXR_READER_KEY, and DEXR_PRIVATE_KEY in a plaintext config file protected by filesystem permissions:

Platform Path Permission
macOS / Linux ~/.config/dexr-outpost/env 0600 (owner read/write only)
Windows %APPDATA%\DEXR Outpost\env Owner-only DACL (set via win32security / icacls)

Why plaintext, not the OS keychain? DEXR Outpost is designed for headless automation (CI pipelines, servers, cron jobs) where keychain integration requires an interactive unlock session. NaCl sealed-box cryptography means the plaintext keys alone are not sufficient to decrypt in-transit data — the sender's private key is also required, and the exchange is pre-arranged out-of-band. Plaintext storage with strict file permissions and regular key rotation is the chosen mitigation; OS keychain integration is explicitly out of scope for v1.

Residual risk: An attacker with user-level code execution on the machine can read the config file (and a keychain-stored secret would be equally accessible once the user is logged in). The primary residual risk is backup exfiltration: backup software that copies ~/.config/dexr-outpost/ (or the Windows equivalent) transfers your keys off the machine. The sections below give concrete exclusion steps for the most common backup tools.

Backup Exclusion

Note: UI paths below are version-dependent. Confirm step details against your current OS version. Steps marked reflect observed behavior as of the documentation date; the underlying config paths do not change between minor OS releases.

Time Machine (macOS)

Time Machine backs up ~/.config/ by default. To exclude the DEXR Outpost config directory:

  1. Open System Settings → General → Time Machine.
  2. Click Options (or the i button next to your backup disk).
  3. Click + under "Exclude these items from backups".
  4. Navigate to and select ~/.config/dexr-outpost/.
  5. Click Exclude.

Alternatively, from the Terminal:

tmutil addexclusion ~/.config/dexr-outpost/

Verify the exclusion was recorded:

tmutil isexcluded ~/.config/dexr-outpost/

iCloud Drive (macOS)

The default iCloud Drive sync scope does not include ~/.config/. No action is required unless you have configured a custom sync directory that overlaps with ~/.config/. If you use iCloud Drive with "Desktop & Documents Folders" sync enabled, verify that ~/.config/ is not inside your synced scope.

If you have configured a custom iCloud sync that does include ~/.config/:

  1. Open System Settings → [Your Name] → iCloud → iCloud Drive.
  2. Click Manage and review the folders listed for sync.
  3. Remove ~/.config/dexr-outpost/ from any sync scope, or move the config outside the synced folder entirely.

OneDrive (Windows)

The default OneDrive "Known Folder Move" (KFM) sync scope does not include %APPDATA%. No action is required unless you have configured a custom sync directory that overlaps with %APPDATA%\DEXR Outpost\.

If you have configured custom OneDrive sync that includes %APPDATA%:

  1. Right-click the OneDrive tray icon → Settings.
  2. Go to Sync and backup → Manage backup and review which folders are backed up.
  3. Remove %APPDATA%\DEXR Outpost\ from the synced scope, or add it as an exclusion via OneDrive's selective-sync settings.

Key Rotation

Rotate your DEXR API keys and private key on a regular schedule and whenever a trigger event occurs.

Baseline cadence: Rotate all keys at minimum every 90 days.

Trigger events requiring immediate rotation:

  • Suspected compromise — any indication that the config file, a backup, or the machine itself was accessed by an unauthorized party.
  • Personnel change — whenever a person who had access to the keys leaves the project or changes roles.
  • Backup exposure — if you discover that a backup including the config file was stored without the exclusions above, treat the keys as potentially exposed and rotate immediately.

How to rotate:

  1. Obtain replacement keys from your DEXR administrator.
  2. In the DEXR Outpost GUI, open the Key Rotation tab.
  3. Paste the new keys and validate them against DEXR before saving (the GUI performs a live probe and only writes on success — an atomic write ensures the config is never left in a partially-updated state).
  4. Confirm the updated config with dexr-outpost config verify.

In-App Warning

The DEXR Outpost GUI Config view displays a banner if it detects that the config file's parent directory is inside a known cloud-sync path (iCloud Drive, OneDrive, Dropbox, or Google Drive). That banner links to this document for the exclusion steps above.

The dexr-outpost init command also prints a pointer to this document after writing the config file:

Config written to ~/.config/dexr-outpost/env
See https://gitlab.com/contextualize/dexr-outpost/-/blob/main/docs/security.md
for backup-exclusion guidance.