The signed-in user sees profile controls and applications they are permitted to launch.
apps.tracernet.orgIDENTITY AND APPLICATION ACCESS
Trust is a route you can inspect.
Tracernet separates the user dashboard, identity authority, and application session so each surface has one explicit responsibility.
ACCESS ROUTE
From account to Atlas.
If an Authentik session already exists, the Atlas launch can reuse it. An expired session or a policy requirement can still trigger reauthentication.
Authentik authenticates the session and authorizes the registered Atlas client.
oidc.tracernet.orgAtlas validates the identity result, checks group entitlement, and creates its own bounded session.
atlas.tracernet.orgIMPLEMENTED IN ATLAS
Controls tied to the actual sign-in path.
This list describes the deployed Atlas authentication boundary. It is not a substitute for an audit or certification.
Authorization code + PKCEAtlas starts a code flow with a unique state, nonce, and SHA-256 PKCE challenge.
Exact identity validationAtlas verifies the signing key, RS256 signature, issuer, audience, authorized party, nonce, issue time, and expiry.
Group-bound entryAn authenticated identity must also carry the configured Atlas Users group entitlement.
Encrypted application sessionAtlas seals its session with AES-GCM and stores it in a Secure, HttpOnly, SameSite=Lax host cookie.
Fail-closed protected routesDocuments redirect to sign-in; unauthenticated APIs return 401 and authorization failures return 403.
Private surfaces stay unindexedThe account, identity, and Atlas surfaces publish no-index response policy.
PUBLIC CLAIMS
No certification by association.
Tracernet does not claim ISO/IEC 27001 certification, FedRAMP authorization, CMMC status, DoD Impact Level authorization, or government affiliation on the basis of design references or website language.
A future compliance claim must identify its scope, assessor or authority, effective dates, and supporting evidence.
COORDINATED DISCLOSURE
Report a security concern.
Use the published contact below for a suspected vulnerability, phishing surface, domain impersonation, or access-control issue affecting an official Tracernet service.
admin@tracernet.org
Identify the affected hostname and path, the observed behavior, potential impact, and the smallest safe set of reproduction steps.
Start a security report ↗Remove secrets before sending.
Do not send passwords, session cookies, private keys, access tokens, or unrelated personal data. Do not perform disruptive testing or attempt to access another user’s information.
Read security.txt →