Built against industry standards. Every control is implemented in code and documented.
A01
Broken Access Control
JWT RBAC with role-based permissions. Org-scoped data isolation on every query.
A02
Cryptographic Failures
AES-256 at rest, TLS 1.3 in transit, ed25519 license signing.
A03
Injection
Parameterized queries throughout. Schema-validated inputs. XSS sanitization on all user-controlled output.
A04
Insecure Design
Privacy-by-design. AI content never stored — SHA-256 hashes only.
A05
Security Misconfiguration
Helmet.js (HSTS, CSP, X-Frame-Options). CORS allowlisting. No default credentials.
A06
Vulnerable Components
Automated dependency scanning. Dependabot-enabled weekly updates. Reproducible builds with npm ci.
A07
Auth Failures
Magic-link auth — no passwords, no credential stuffing. Short-lived signed JWTs. OIDC/SSO for enterprise deployments.
A08
Integrity Failures
SHA-256 installer checksums. ed25519-signed license JWTs. Pinned lock files.
A09
Logging Failures
Structured JSON audit logging. Sensitive fields sanitized at source. Tamper-evident event trail.
A10
SSRF
No external URL fetching from user content. Outbound connections allowlisted.
Zero Trust Data Flow
AI content is never stored. SHA-256 hashing means violations are auditable without retaining sensitive data.
Cryptographic Verification
Every installer bundle is SHA-256 signed. License JWTs use ed25519 — the same algorithm that secures SSH keys.
Self-Hosted by Design
Your data never leaves your infrastructure. No phone-home analytics, no cloud dependency for policy decisions.
