Skip to content

Security

Jump to bottom
sikkatu edited this page Nov 2, 2026 · 3 revisions

English | Русский | 中文

Security

Threat model

Persistent KV data is derived from prompts — treat the cache directory as if it contained the conversation text itself. Inverting KV activations back to prompt content is effortful but not impossible.

Controls in this project

Control Implementation
Filesystem permissions KVP_CACHE_ROOT created chmod 700; no script ever loosens it. The systemd wrapper (systemd/kvp-lmcache-server) enforces 0700 at startup and refuses to run without it — StateDirectory= alone would create the directory 0755, and a world-readable cache root is a breach of this threat model (KV data is chat text in disguise).
Management endpoint lmcache HTTP frontend binds 127.0.0.1 only; do not proxy without authentication
Cache request port ZMQ on 127.0.0.1:5555 (loopback)
Credentials never in the repository or cache config; the vLLM API key lives in the recipe's own live/api_key (chmod 600, gitignored)
Logging scripts and admin CLI log keys, sizes and counts only — never prompt text or headers
Namespace isolation incompatible deployments cannot read each other's KV data
Deletion safety purge refuses paths outside KVP_CACHE_ROOT (exit 2) and requires --yes. The cache is FLAT: *.bin files directly under the root (namespaces are file-name prefixes), plus legacy kvp-* dirs if any. Targeted cleanup by EXACT namespace name (purge --namespace=NAME --yes), bulk by purge --all --yes, crash leftovers by purge --tmp --yes (which never touches real cache files or in-flight writes)
Shared storage unsupported as cache root (preflight warns on network filesystems)
Startup wipe never happens — preserved across restarts and upgrades
Explicit cleanup bash scripts/budget-report.sh purge --namespace=NAME --yes / purge --all --yes / purge --tmp --yes — manual only

Rules for operators

  • Do not put the lmcache HTTP frontend behind an unauthenticated reverse proxy. For remote diagnostics use SSH port forwarding instead of exposing it.
  • Do not copy KVP_CACHE_ROOT between hosts (its content is prompt-derived).
  • Do not log prompt text while debugging; use keys/counts (all shipped tools follow this rule).
  • Treat budget-report.sh status output as private: lengths, dates and reuse counts are user-activity metadata.
  • Rate the cache root's sensitivity equal to chat logs — at minimum same backup/ access policy.

Repository safety

  • No credentials, tokens, conversation text or cache data in the tree (the review checklist for external reviewers includes a credential grep).
  • GitHub fine-grained tokens used for pushes are revoked and re-issued after the work session; they are never committed, only used in local git command URLs.

Reporting a security issue

Use the private repository channel (issues of sikkatu/kv-persistence); public disclosure only after triage.

Clone this wiki locally