The component that holds every credential you own
This page is about Wäg's own security posture — what it ships as, how it handles your secrets, what it requires from your network, and how to report a vulnerability. For what Wäg does to protect your AI traffic, see AI security.
Its supply chain is your supply chain
Your gateway holds every provider credential your organization owns and sits in the path of every AI request. That makes its dependency tree part of your attack surface, not just ours.
So the data plane is deliberately small and static. There is no interpreter, no package manager, and no transitive dependency tree resolved at deploy time.
A distroless, non-root image
No shell, no package manager, no interpreter in the image. Minimal attack surface and nothing to resolve at runtime.
Signed images
Every image is signed keyless with cosign and recorded in the public Sigstore log; SLSA provenance and SBOM attestations ship where the release notes list them.
An SBOM per version
Full dependency inventory shipped with each version, so your own scanning sees what we see.
The console needs no extra runtime
The admin console is served by the same Rust binary. The optional console assistant is a separate image: distroless Node, no shell or npm.
What we assume goes wrong
The controls Wäg provides against the failure modes specific to sitting in front of every model call.
| Failure mode | Control |
|---|---|
| Provider credentials leak from an application | No application ever holds one. Virtual keys are issued per team, user or service with independent revocation; with vault references provider keys never reach the database, and an inline key is stored sealed (AES-256-GCM). |
| Sensitive data leaves in a prompt | Ordered scanner chain pre-call, mid-stream on a rolling window, and post-call. Block, mask or redact per rule, with verdicts recorded. |
| Prompt injection or untrusted model output | Pre-call and post-call scanning stages, plus mid-stream abort so a compromised stream does not reach the client in full. |
| An agent acts beyond its authority | Per-server MCP credentials, tool allow-lists, approvals, per-server call limits, every call logged. Access is open by default; switch that off for least privilege. |
| Records are altered after the fact | The evidence ledger hash-chains every provider call and refusal and signs checkpoints with Ed25519; waeg ledger verify checks an export offline. In required mode: no evidence, no egress. |
| A dependency is compromised | Distroless non-root image, no deploy-time dependency resolution in the data plane, cosign-signed images, an SBOM per release, provenance where the release notes list it. |
Your vault, not our database
With vault references, provider credentials resolve from your own secret manager and never reach the database; resolved keys are cached in memory for a configurable TTL, so rotation in your vault needs no Wäg deployment change. A key entered inline is stored sealed with AES-256-GCM.
No required egress
Not as a configuration option — as a property of the software. Check it at your own network layer.
- No prompts
- No completions
- No provider keys
- No logs
- No telemetry
- No online licence check
- No usage analytics
No outbound connection is required for the gateway to operate: offline price book, local policy engines, in-process semantic cache. Deployable with no internet egress at all.
Reporting a vulnerability
Report security issues to the address on our trust centre. We will acknowledge, investigate, and credit reporters who want credit. Please give us a reasonable window before public disclosure, and tell us the image version and digest you tested.
We hold no third-party security certifications, and we will not imply otherwise. What exists instead is verifiable rather than attested: images signed with cosign, an SBOM per release, an offline licence, and a deployment model where you are the operator and most controls are yours to evidence.
One endpoint. Every model. Complete control.
Run it in your own infrastructure
Everything you need to run a control plane in production is Apache-2.0 and stays that way — routing, HA, caching, failover, budgets, policy, MCP, jobs and observability. Self-hosted, no account, no phone-home.
$ docker run -p 4000:4000 <registry>/waeg-gateway:<version>Not a working pull: the images are not public yet. Design partners receive the registry details privately.
Deploy in 5 minutesShape it as a design partner
Wäg is not publicly released yet. We are working with a small cohort of teams running multi-provider AI in production, and serious about governance and sovereignty, to harden the control plane on real workloads.
- Every Enterprise capability included, at no licence cost
- Hands-on migration — we do it with you, including from LiteLLM
- A direct line to the engineers building it, and real influence on what ships next