1. Read-only control plane
CloudSlash separates observation from execution. Horizon SaaS connects to your systems using strictly read-only credentials or ingested CLI snapshots. When your team approves an optimization, Horizon compiles an ephemeral, Ed25519-signed S.A.U. plan that your engineers execute in their own environment. Once executed, the plan becomes an immutable audit record.
2. Encryption & tenant isolation
All network communication uses TLS 1.2/1.3. Source connection credentials and BYOK model keys are encrypted at rest using envelope AES-256-GCM encryption. Every API request is authenticated via short-lived JWTs and scoped to your organization ID.
3. Plugin verification
CLI plugins validate SHA-256 binary checksums and manifest signatures prior to local execution. Hosted gRPC plugins require explicit operator endpoint approval before they can be added to a Horizon workspace.
4. Responsible vulnerability disclosure
If you discover a potential security vulnerability, please email support@devilabs.dev with reproduction details and affected endpoints. We acknowledge reports promptly and coordinate remediation prior to public disclosure.