Administration & security
Security evidence pack
A new name. The same foundation. KratosForge is the upcoming name for Fabric Desktop by KratosBI. These guides preserve the app’s current labels and paths.
Everything a security or IT team needs to review Fabric Desktop by KratosBI before approving it, in one place. Each row links to the page or file that holds the evidence. Where something is missing or unverified, the row says so.
Last checked against main a346145 (2026-10-18). Nothing in this pack has been verified on a live Fabric tenant yet. That is gate 3 in the readiness checklist.
At a glance#
| Question a reviewer asks | Answer | Evidence |
|---|---|---|
| What is it? | A Windows desktop app that runs Fabric notebooks and SQL on the PC and reads and writes OneLake with the person's own sign-in | Architecture |
| Does it need an app registration or secrets? | No. It signs in with Microsoft's Fabric CLI public client and the Windows account broker | Permissions |
| What can it do in Fabric? | Only what the signed-in person's Fabric roles allow. Every call uses their delegated token | Permissions: what each feature uses |
| Does it listen on the network? | No by default. Only if someone turns on Settings > Integrations > Local HTTP, and then on 127.0.0.1 only, with a token per tool |
Security model: trust boundaries |
| What leaves the PC? | Calls to Microsoft (sign-in, Fabric, OneLake, Power BI, Graph), update checks to GitHub, and usage counts only if turned on | Data flows below |
| Is customer data collected? | No. Usage data is off by default and never holds data, names, accounts or tenants | Usage data |
| Can IT control it? | Yes. A policy file fixes settings for everyone, including tenants allowed, runs in Fabric, updates, telemetry and AI tools | Configure Azure and Fabric: policy file |
| Is it signed? | Not yet. Waiting on a code signing account | Release readiness, row 1 |
| Is the sign-in cache encrypted? | Not yet. It is a plain file in the user's profile | Security model: threats |
Documents#
| Area | Document |
|---|---|
| Threat model, trust boundaries, open risks | Security model |
| Sign-in, scopes and roles | Permissions |
| What is installed and where files live | Install: where things are kept |
| Deployment, update models, rollback, network hosts | Enterprise install |
| Tenant settings and the policy file | Configure Azure and Fabric |
| Usage data, field by field | Usage data |
| External AI tools: local API, approvals, audit | AI integration security |
| Audit trail | User guide: audit trail |
| Backup and restore | Back up and restore |
| Support bundles and logs | Troubleshooting |
| Independent code audit, findings and fixes | Hardening audit, findings, release gates |
| What an approver will still find missing | Release readiness |
| Live test harness, for a pilot tenant | Live testing |
Data flows#
| From | To | What | When | Protection |
|---|---|---|---|---|
| The app | login.microsoftonline.com |
Sign-in | When someone signs in or a token renews | Microsoft identity platform; Windows account broker |
| The app | api.fabric.microsoft.com, onelake.dfs.fabric.microsoft.com, api.powerbi.com, graph.microsoft.com |
Fabric items, jobs, OneLake files and tables, semantic models, people lookups | When someone uses those features | HTTPS with the person's token; writes are version-checked and ask first where they replace data |
| The app | app.fabric.microsoft.com |
Fabric's own pages, shown inside the app | When someone opens them | The embedded view's cookies are encrypted with Windows DPAPI |
| The app | github.com and its release hosts |
Update check and downloads | Each time the app starts, unless the policy turns updates off | SHA-256 checked against the release's version.json; not yet signed |
| The app | The organization's central lakehouse (FabricDesktop_Central) |
Optimization results and other organization-wide tables | Only after someone connects it and agrees to each first write | The person's token; allow_optimize_lakehouse: false turns it off |
| The app | onelake.table.fabric.microsoft.com |
Lists of OneLake tables and their schemas | When someone browses lakehouse tables | HTTPS with the person's token; reads only |
| The app | The person's own Git remotes (Azure DevOps, GitHub, GitLab, Bitbucket or another host they add) | Notebook and item source they push or pull | Only when someone connects a repository and pushes, pulls or clones | Git's own HTTPS sign-in to that host |
| Notebooks run on the PC | {vault}.vault.azure.net, plus Kusto, storage and Power BI token audiences |
Secrets and tokens the notebook asks for (notebookutils.credentials) |
Only when notebook code calls getSecret or getToken |
The person's own token for that resource |
| Notebooks run on the PC | Any host the notebook's own code calls | Whatever that code sends | When the notebook runs | Same as any script the person runs; the app doesn't filter it |
| The app | A Teams incoming webhook | Alerts someone set up | Only if configured | Webhook address redacted from every log and error |
| The app | Application Insights (KratosBI's, or the organization's own) | One daily record of action counts, failures and timings | Only if usage data is on | No data, names, accounts or tenants; policy can force it off |
| External AI tools | The app's local API on 127.0.0.1 |
Requests the person approved | Only if Integrations are turned on | Token per tool, loopback only, no browser requests, every call audited |
These are the flows the app itself starts, from the hosts named in its source code. Notebook code can reach other hosts, as it would anywhere else it runs, and Microsoft can redirect sign-in or downloads. Confirm the list from one pilot PC behind your proxy (network access).
Build and release evidence#
| Evidence | Where | State |
|---|---|---|
| SBOMs (CycloneDX) for the shell and the engine | sbom-app.cdx.json and sbom-engine.cdx.json on each Preview release (latest) |
Made for every Preview build. The Stable release carries only the exe, engine and version.json |
| Build provenance attestations | Checked with gh attestation verify <file> -R KratosDataGod/fabric-desktop |
Made for every build. Nothing on the PC checks them yet |
| SHA-256 checksums | version.json on each release |
Enforced by the app for the exe and the engine |
| Dependency scanning | pip-audit and cargo audit in CI on every pull request |
In place |
| Pinned dependencies | sidecar/constraints.txt, Cargo.lock with --locked |
In place |
| Pinned CI actions | Third-party actions in ci.yml pinned by commit |
In place; two smaller workflows still pin by tag (SH-8) |
| Code signing | Authenticode via Azure Trusted Signing | Not in place: needs the signing account |
Still open#
These are the items a reviewer will raise. They are tracked in release readiness:
- unsigned builds;
- the plain-text token cache;
- no Content Security Policy;
- no live tenant run;
- no pinned builds or rollback;
- no MSI or MSIX;
- Preview features.
A privacy statement and support terms are being drafted for KratosBI to approve as the publisher.
Reporting a vulnerability#
Use GitHub's Report a vulnerability on the repository's Security tab, or contact KratosBI directly. Please don't open a public issue.
Need a hand?
Find a fix in troubleshooting, or share a reproducible issue with the community.
Get support ↗Improve this guide on GitHub ↗