Skip to content
AevornixAEVORNIX
Company

Security

How Aevornix handles security in the systems that are actually running, and how to report something you find.

Contact Aevornix Privacy
RVStack architecture

RVStack architecture, 7 layers from top to bottom: 01 Application, 02 Development toolchain, 03 Portable runtime, 04 Operating layer, 05 RISC-V architecture, 06 Device profile, 07 Deployment target.

  1. Application
    Games, tools and software targeting the Aevornix platform.
    .aev project format
  2. Development toolchain
    Compiler, linker, debugger, SDK and build systems.
    ELFDWARF
  3. Portable runtime
    Execution services shared across supported RISC-V targets.
  4. Operating layer
    System services, permissions, storage, networking and application lifecycle.
    POSIX-style system interfaces
  5. RISC-V architecturefoundation
    The open instruction-set foundation beneath the software stack.
    RV64GCRVA23
  6. Device profile
    Defined hardware capabilities used for emulation and compatibility testing.
  7. Deployment target
    Physical devices, virtual environments, cloud targets and certified platforms.
    linux-riscv64

In production today

The Store and its API are the live surfaces, so these are the properties that currently matter.

Session handling
Sign-in uses http-only session cookies with rotating refresh. No tokens are stored in the browser.
Cross-site protection
Same-site cookies with CSRF protection on state-changing requests.
Secret handling
Provider secrets are held in managed secret storage and injected at runtime, not baked into images.
Data location
Services run in europe-west1 with data stored in the corresponding European region.

Reporting a vulnerability

Report suspected vulnerabilities through the company contact route, with enough detail to reproduce the issue. Please do not disclose publicly until it has been addressed.

Security | Aevornix