Architecture: Security Controls

Firezone employs a few different security controls to keep data secure in transit and at rest.

Overview of cryptography used

Below is a table of cryptography used and to which contexts they apply.

Cryptography	Context	Notes
AES-256-GCM	Data at rest	Used to encrypt sensitive data that needs to be persisted, such as authentication tokens.
TLSv1.2/TLSv1.3	Data in transit	Used to encrypt connections to the admin portal and control plane API.
ChaCha20, Poly1305, Curve25519, BLAKE2s, SipHash24, HKDF	Data in transit	Used by WireGuard® for VPN tunnels. Read more at https://wireguard.com/protocol. Firezone uses the `boringtun` WireGuard implementation.
SHA-256	Data at rest	Used to store hashed+salted randomly-generated authentication tokens.

We take security issues very seriously and strive to fix all security issues as soon as they're reported.

We'll announce major security issues on our security mailing list located at:

We release security patches for supported versions of Firezone. We recommend running the latest version of Firezone at all times.

See upgrading for more on how to keep Firezone up to date.

Please do not open a public GitHub issue for security issues you encounter.

Instead, use one of the following methods:

Report a vulnerability on GitHub. This will be visible to the Firezone security team but not the general public.
Send an email to security AT firezone.dev describing the issue and we'll respond as soon as possible.

You may use the public key below to encrypt emails to security AT firezone.dev. You can also find this key at:

See all support options or try asking on one of our community-powered support channels:

Discussion forums: Ask questions, report bugs, and suggest features.
Discord server: Join discussions, meet other users, and chat with the Firezone team
Email us: We read every message.

Or try searching the docs: