Security

Reporting a vulnerability

Report security issues privately through GitHub security advisories, not public issues. We’ll acknowledge your report within a few days and keep you updated on the fix.

Threat model

Cascadia is designed to run on a trusted LAN, such as a rack of Intel AI PCs on an isolated subnet. It isn’t designed for the public internet. Hardening covers malformed input, so bad requests can’t cause panics or unbounded allocations. It doesn’t cover authentication or transport encryption.

Built-in protections

• HTTP API: requests are limited by body size and rendered prompt size (both set by --api-max-body-mb, default 1 MiB) and by a 16-request concurrency limit. An oversized prompt returns 413, and a request over capacity returns 503. Engine errors return 5xx responses instead of crashing the worker.
• Engine queue: the OpenVINO engines hold at most 256 pending tasks. Past that, requests return 503.
• TCP relay: tensor payloads are capped at 256 MiB and raw control messages at 64 KiB. Shapes are checked for overflow before allocating, and every receive times out after 60 seconds. A stalled or hostile peer can’t tie up a worker thread or force a multi-gigabyte allocation.
• C++ shim: every exported function checks for null pointers, property dictionaries are limited to 256 pairs, and C++ exceptions are caught before they reach Rust. Tensor shapes are checked for overflow.
• Numerics: argmax handles NaN and logs a warning instead of silently returning token 0 after a broken forward pass. Rotary embeddings clamp start to 16M positions and seq_len to 1M tokens.
• Model registry (cascadia-download): writes are atomic (temporary file, fsync, rename), a symlink at the registry path is rejected, the file is capped at 16 MiB, and parse errors fail instead of being ignored.

Not included

• TLS on the HTTP API or the inter-stage TCP relay
• Client authentication on the HTTP API
• mDNS authentication
• Supply-chain pinning beyond Cargo.lock

Deploying beyond a trusted LAN

Put a reverse proxy that handles TLS and authentication in front of the --api port. Firewall the inter-stage ports (--listen and --next) so only the other workers in the pipeline can reach them.