Security

Project permissions are checked on the server. Report files remain private, and the viewer receives short-lived access links. Agent tokens have explicit project scopes and can be revoked.

Publication freezes a release’s analytical files and provenance. A correction creates a successor release, preserving the earlier result and its feedback. Database guards and automated tests protect these rules; administrator access to the database remains a privileged responsibility.

HTML reports run in an isolated, sandboxed viewer. A report can still display misleading content, propose misleading review locations or interrupt focus. Never enter a password, token or other credential inside a report.

Browser sandboxing does not block every network mechanism, including WebRTC. Use trusted report sources and appropriate test material. Isolation does not establish scientific validity or guarantee that an authored report is harmless.

Contact the owner through the private channel that gave you access. Public issue trackers are unsuitable for sensitive vulnerability details.

Provide the affected version or commit, safe reproduction steps, expected and observed behavior, and the potential impact. Use synthetic examples and include a request reference if available. Do not send credentials, session cookies, signed report links or other people’s data.

Test only systems and accounts you have permission to use. If you encounter another person’s data, stop and report the minimum information needed for the owner to investigate.

The alpha is still being developed and verified. Hosted backup settings, restoration exercises and live integration checks need owner evidence before external use. This alpha makes no HIPAA, GDPR, SOC 2 or institutional approval claim.

The owner will assess a private report, coordinate a fix and agree on disclosure when appropriate. There is no guaranteed response deadline or bug bounty program.