Xibernetix - Security Practices

Passkey-First Authentication

Xibernetix is built on the FIDO2/WebAuthn standard. We eliminate the risks associated with passwords, such as phishing, credential stuffing, and brute-force attacks, by using public-key cryptography.

No Passwords Stored: We never store secrets that can be stolen from our servers.

Hardware-Backed Security: Your private keys remain on your device's secure element (e.g., TPM, Secure Enclave).

Anti-Phishing: WebAuthn credentials are tied to our specific domain, making phishing impossible.

Data Encryption

We protect your data both at rest and in transit.

In Transit: All communication between your device and Xibernetix is encrypted using TLS 1.3 or 1.2.

At Rest: Sensitive data in our databases is encrypted using AES-256 encryption.

NFC key threat model

Secure NFC deployments depend on protecting each tag's cryptographic master key and the information used to assign that key. The following scenarios help Product Brands evaluate the required manufacturing and handling controls.

Unassigned tag key

Threat: A tag that has not received an assigned cryptographic master key remains on a generic or factory credential. A rogue app that can use that credential may attempt to pair with or provision the tag.

Impact: The tag could be associated with an unintended device or workflow before authorized provisioning establishes its protected identity.

Controls: Use a manufacturer-injected, tag-specific key where appropriate, or complete first provisioning only with the authorized Xibernetix mobile workflow. Treat generic credentials as a controlled pre-provisioning state.

Deployment note: This risk is most relevant to generic-key tags before they have been secured.

Manifest exposure during handling

Threat: An employee or other unauthorized party could observe or copy a tag manifest during transport, staging, or import if the file-handling process is not strictly controlled.

Impact: A copied manifest can expose tag inventory and, when it contains or enables access to assigned key material, weaken the security boundary around those tags.

Controls: Encrypt manifests in transit and at rest, limit access to approved roles, use authenticated transfer paths, record imports, and keep key material separate from routine inventory handling where possible.

Deployment note: This applies to every credential model because every assigned tag must be recorded in a Maker manifest.

Infrastructure Security

Our infrastructure is designed for resilience and security.

Isolation: We use containerization and network isolation to prevent lateral movement in the event of a breach.

Regular Audits: We perform automated security scans and manual code reviews to identify and mitigate vulnerabilities.