Security approach
- Defense-in-depth: layered security controls across services.
- Least privilege: access is scoped to what is required.
- Monitoring: logging and alerting for abnormal activity.
- Proof-first communication: public trust routes show what is verified today.
Current evidence
- Evidence-backed scoring instead of fixed marketing numbers: 16/16 checks currently pass across architecture, implementation, foundation, and operations.
- Operational visibility is publicly exposed: Health, build, readiness, status, and metrics endpoints are committed and available for monitoring and verification.
- Security-first platform foundations are already in place: The repo includes passkey/WebAuthn support, audit-aware administration, and scripted verification gates for deployment confidence.
Reporting a vulnerability
Please report security issues via Contact. Provide steps to reproduce, impact, and any supporting evidence.
Verification endpoints
- Readiness scorecard API — Machine-readable category scores derived from repo evidence and verification scripts.
- Build metadata — Reports the currently serving build commit and deployment context.
- Health check — Lightweight service health response with build-aware diagnostics.
- Readiness check — Runtime dependency readiness for the app shell and core APIs.
What we are not overstating
- Feature activation is still broader than the current live surface: The detailed feature matrix still includes PARTIAL and PLANNED capabilities, so the repo now tracks honest completion through a strict activation manifest instead of flipping everything to LIVE by declaration.
- Public load and failover artifacts are still pending: The k6 harness is in-repo and the Windows Docker path handling was hardened, but smoke/stress artifacts still need to be generated and published before stronger resilience claims are fair.
User security tips
- Use strong, unique passwords and enable 2FA when available.
- Beware of phishing and verify links/domains.