Defense in depth
YAKKL uses layered security controls designed so that no single component failure compromises project data, credentials, or execution authority.
Security
Security is the operating model, not a feature
YAKKL is built for teams with valuable code, credentials, and authority at risk. Security practices are embedded in how we design, build, and operate — not bolted on after the fact.
Practices
How we protect users and systems
These practices apply across YAKKL. Security-critical code is isolated in dedicated packages with restricted access and additional review requirements.
Principle of least privilege
Systems, services, and internal tools operate with the minimum access required. API keys, credentials, and session tokens are scoped, rotated, and revoked through controlled lifecycle management.
Encryption at rest and in transit
Sensitive data is encrypted in transit using TLS 1.2 or better, with TLS 1.3 preferred. Data at rest is encrypted using AES-256 or equivalent. Key material is designed not to leave secure boundaries without explicit user action.
Secure development lifecycle
Code changes go through review. Dependencies are monitored for known vulnerabilities. Security-critical code receives additional scrutiny and is isolated in dedicated packages with restricted access.
Responsible disclosure
Report a vulnerability
If you discover a security vulnerability in YAKKL, we want to hear about it. We follow a coordinated disclosure process to protect users while fixing issues.
- 01
Report
Send your findings to security@yakkl.com. Include a clear description, reproduction steps, and impact assessment.
- 02
Acknowledgment
We aim to acknowledge receipt within two business days and provide a tracking identifier for your report.
- 03
Assessment
Our security team evaluates the report, determines severity, and begins working on a fix or mitigation.
- 04
Resolution
Once resolved, we notify you and coordinate public disclosure timing. We generally credit reporters unless anonymity is requested.
Report vulnerabilities to security@yakkl.com. Please do not disclose vulnerabilities publicly until we have had reasonable time to address them.
YAKKL security model
Execution integrity for AI workflow
YAKKL handles plans, artifacts, session state, and model routing. The security model protects the work, the credentials, and the execution path.
Keys are scoped to their boundary
BYOK provider keys, managed execution keys, and session tokens are scoped per tier. Keys are stored encrypted, rotated on schedule, and are not written into plan artifacts or session logs.
Plans and artifacts are inspectable
Master Plans, handoffs, and audit trails are persisted in plain files with state tracking. Changes to execution state are logged, so the path from request to result can be reviewed after the fact rather than reconstructed from memory.
Governance scales with the plan
Orchestrator includes local execution controls and BYOK. Teams and Business add RBAC, shared session policies, and admin oversight. Enterprise adds compliance export, dedicated key pools, and governance gates.
See how execution works in the orchestration flow.
Found something?
Responsible disclosure reports go straight to the security inbox.
Report a vulnerability