How we hold what you trust us with

01Authentication

• Sessions are RS256 JSON Web Tokens verified against our provider's published keys. The signing algorithm is pinned, so a token cannot be downgraded to an unsigned one.
• Issuer, audience and expiry are all required. If the audience is not configured, the API refuses to start rather than accepting tokens for the wrong tenant.
• Every authentication failure returns the same response, so the endpoint cannot be used to tell a wrong password from an unknown account.
• API keys for CI are separate credentials, and reach exactly six endpoints: price a run, start it, poll it, read the findings, mint the receipt, list your own agents. A leaked key cannot issue another key, change billing, or read account settings.

02Your data at rest

• Agent credentials are encrypted with AES-256-GCM. The key lives in the environment, never in the database, and each stored value is bound to the column it belongs to so a ciphertext cannot be moved between them.
• No part of the interface or the API returns a stored credential, including to its owner. They can be replaced or cleared, not read back.
• Your agent's answers, execution traces and evidence excerpts are automatically replaced with a marker after 90 days. Scores and attestations remain, so a receipt keeps verifying after the text behind it has gone.
• The database and cache are not reachable from the internet. Only the web tier accepts inbound connections.

03Running against your endpoint

The gate dials a URL you supply, which is a capability worth constraining tightly, and is.

• Cloud metadata addresses, link-local, multicast and reserved ranges are refused outright, with no configuration that re-enables them in production.
• Private and loopback addresses are refused in production.
• The address is resolved once and the connection is pinned to it, so a name that resolves safely and then changes cannot redirect the request into a private network.

04The application

• HSTS, frame denial, MIME-sniffing protection, a same-origin opener policy and a no-referrer policy on every response.
• Interactive API documentation is disabled in production.
• Server errors return a fixed envelope. The exception text, the stack trace and the request body never appear in a response; the full trace goes to our logs only.
• Text captured from an agent is redacted structurally before it is shown anywhere — keys, tokens, card numbers and similar are matched by shape, not by keyword.
• Every build runs a secret scan and a dependency audit, and a deploy fails if either does.

05What we have not done

Stated plainly, because you would find these anyway and a page that hid them would put every other line on it in doubt.

• No third-party penetration test or security certification. We have not been audited by anyone, and we do not claim to have been.
• Grading sends your agent's answers to a judge model we do not host. That is inherent to the product, not an oversight — see the privacy page for what it means for you.
• Single-region deployment with no failover. A regional outage takes the service down; it does not lose data, but it does stop runs.

06Reporting something

If you find a vulnerability, write to ceo@labs67.com with enough detail to reproduce it. We will acknowledge within two business days and tell you what we are doing about it. We will not threaten you, and we will credit you if you want to be credited.