DCA Hardened Secrets Manager — for OpenBao™ — security notes

• No shared or default credentials are included in this image. Access uses the SSH key you supply at launch; any application credential is generated uniquely on your instance at first boot and stored only there — we never know it.
• Telemetry: none. Our images contain no phone-home, no usage beacons, no license servers. The only parties that know you deployed our software are you and your cloud provider's billing system.
• We have no access to your deployment. Your instance runs in your tenancy under your IAM; remote access for a support session exists only if you explicitly grant it, and you can revoke it at any time.
• Rebuild cadence: every image is rebuilt at least monthly against current OS security advisories, and event-driven when a critical CVE with an available fix lands. Vulnerability scanning gates every build.
• Report a vulnerability: disclosure policy.

Network exposure

Port	Purpose	State
22	SSH — key-only, OS Login (IAM); the deployment package adds no SSH rule	your VPC's firewall rules
8200	OpenBao API + UI, TLS (per-VM certificate) — bound to 127.0.0.1	customer-must-open (config + firewall toggle)
8201	Cluster port — 127.0.0.1 (single node)	loopback only

"customer-must-open" means a cloud firewall rule and, where noted, an in-image configuration change — both deliberate. Closed by default is the design.

Shared responsibility

We maintain	The hardened image: package selection, hardening baseline, CVE rebuilds, listing freshness, and these docs.
You control	The running instance: OS patching between image versions, network exposure, IAM, data, and backups.
Your cloud provides	Physical/hypervisor security, marketplace billing, and the firewall primitives this design relies on.

OpenBao™ names the open-source software this image packages. Derek Coleman & Associates Inc is not affiliated with or endorsed by the OpenBao project.