Security model

Applies to SynapseOS builds from 2026-10-09 (20261009-141152 and later). See What changed.

Nothing runs on the unit that Gen0Sec did not sign; whether firmware enforces that is the platform's setting.

The boot chain

Each link checks the next, and the chain starts in firmware.

Link	What it checks
The firmware	The kernel image's signature, against the Gen0Sec certificate enrolled in its Secure Boot key store
The kernel image	Kernel, initrd and command line are one signed file. The command line carries the hash of the system (/usr) this kernel belongs to
dm-verity	Every block of /usr is checked against that hash as it is read. A changed block is a read error, not a silently different file
Kernel lockdown	In integrity mode: no unsigned kernel modules, no kexec, no access to kernel memory from userspace

So a modified binary, library or module cannot be run, a different kernel cannot be booted, and the kernel command line cannot be edited at the boot menu. If an update does not verify completely, it is never the system that boots.

Firmware Secure Boot state

Whether the first link is enforced depends on the platform's firmware setting: a server or VM can have Secure Boot off, and BlueField-3 units are delivered with it off (see Platforms). With it off, the signature on the kernel image is not checked by firmware. The dm-verity check on /usr and the kernel's own restrictions do not depend on that setting and hold either way.

On the running system

• Hardened units run a jailer: a kernel-level policy that confines Synapse and the system services to what they need. The policy is part of the sealed system; there are no local overrides, and the directory where overrides would go is empty, read-only and audited.
• Inbound traffic is dropped by default, except SSH. See The base firewall.
• SSH accepts root with a key only. Passwords work on the console only, and only where one has been set. See Logging in.
• Changes are audited. auditd records changes to configuration, credentials and the system's own files; the journal is persistent and bounded. See Logs.
• There is no package manager and no compiler. The unit cannot install software, and no tool on it can modify /usr.

What leaves the unit

Flow	To	What it carries
Platform traffic	api.gen0sec.com, 443	Registration, detections and the telemetry Synapse is configured to send; access rules, fleet bans and verdicts coming back. platform.telemetry_sending_enabled and platform.include_response_body on the Configuration page say how much of a request leaves
Database downloads	download.gen0sec.com and the GeoIP host, 443	Nothing outbound beyond the request; indicator, threat and GeoIP databases inbound
Updates	The host in UPDATE_BASE_URL, 443	Nothing outbound beyond the request; the signed archive inbound, and only when you run check or update
Logs	Your collector	Everything in the journal, which includes Synapse's events; only if you configured forwarding

Nothing else opens a connection, and nothing connects in except SSH and, where you run it, the proxy. The full host and port list is on Network requirements.

The audit rule set records changes to the files on the Configuration reference, to credentials, to the system's own files, and to the jailer's override directory; it does not record traffic.

Before an update is installed

An update is accepted only if its manifest and the channel pointer both carry a valid signature from the Gen0Sec release key the unit already trusts, every file's digest matches the manifest, the version is newer than the one running, and the update is of the same variant as the unit. The new kernel image is then checked by firmware at boot like any other, and the new /usr by dm-verity. Details and commands are on Updating.

What is not covered

The appliance protects the integrity of what runs on it. It does not encrypt data at rest: configuration, keys and logs on the writable partition are readable from a disk removed from the unit. Treat disposal and transport of a unit accordingly. See Known limitations.

Reporting a vulnerability

If you believe you have found a security vulnerability in SynapseOS or any Gen0Sec software, report it privately to [email protected]. Do not open a public issue. Include the affected component and version, the configuration, and steps or a proof of concept that trigger the issue. Sensitive details can be encrypted to the Gen0Sec package-signing key, fingerprint C1631499081A7146332D2038798FF49A6E9DA146.

We will acknowledge the report, investigate, and keep you informed of the resolution. Please allow a reasonable opportunity to release a fix before any public disclosure.