Security
Security posture
This page describes public design and disclosure expectations. It does not claim a certification, audit or compliance attestation.
Posture
Security properties users can understand
Implementation detail stays in the source. The public site describes the practical consequence for the operator.
- Repository-owner review
- DoneState prepares reviewable repository changes and does not claim the final merge decision for itself.
- Inspection without mutation
- OpsTruth is designed to inspect software evidence without deploying, merging, publishing or restarting the system it checks.
- Credential control
- Operators remain responsible for repository access, secret storage and the credentials used in their own environments.
- Product maturity
- Security-relevant behaviour that is still planned, including AgentProof design goals, is not presented as already shipped.
- Public source
- Repositories and published releases can be inspected directly instead of relying only on security marketing copy.
- Private disclosure
- Vulnerability reports can be sent privately to security@proofandstate.com.
Operator responsibilities
What remains yours
You remain responsible for repository access, secret storage, network policy, dependency choices and the security of the systems the tools interact with.
Reviewable automation reduces some operational risk; it does not remove the need to review access and changes in the context of your own environment.
Disclosure
Reporting a vulnerability
Report privately first and include enough information to reproduce the issue.
Email security@proofandstate.com with the affected repository or component, the issue and reproduction steps.
A private security advisory on the relevant GitHub repository is also appropriate where available.
Proof & State does not currently claim a paid bug bounty programme.
Move faster. Keep the evidence.
Security claims should be as bounded as the products they describe.