Security
Security posture
This page describes how the system is designed and how to reach us about a vulnerability. It does not claim certifications, audits or compliance attestations, because none have been performed.
- Least authority
- No write path
- Signed effects
Posture
Design properties relevant to security
These are architectural facts about how the layers are built, not guarantees about your deployment of them.
- Read-only verification
- OpsTruth holds no write authority over the systems it inspects. It does not deploy, mutate databases, publish, or restart services.
- Least authority
- Every component is granted the narrowest scope that lets it do its job, with explicit denials declared before admission.
- PR-first remote mutation
- Changes to remote systems are proposed as reviewable artefacts rather than applied directly wherever the workflow allows it.
- Exactly-once execution
- Consequential actions are keyed for idempotency so an interrupted transaction does not repeat a side effect on recovery.
- Signed receipts
- Consequential actions produce a receipt bound to the exact prepared state and the authority it was executed under.
- Secret handling
- Credentials are supplied by the operator through their own environment. The tooling does not require credentials for capabilities it does not have.
Operator responsibilities
What remains yours
The tooling runs in your environment, against your repositories, with credentials you control. Access management, secret storage, network policy and the security of the systems being inspected remain your responsibility.
Authority envelopes are only as narrow as you declare them. The system enforces the envelope you write; it cannot infer a safer one on your behalf.
Disclosure
Reporting a vulnerability
Report privately first. Please give us a reasonable window to respond before publishing details.
Email security@proofandstate.com with a description of the issue, the affected repository or component, and steps to reproduce it.
Alternatively, open a private security advisory on the relevant repository under github.com/AyobamiH.
We do not currently operate a paid bug bounty programme. We will acknowledge reports and credit reporters who want credit.
Give agents authority. Keep the proof.
Narrow authority is the security control that survives autonomy.