# Security (beta)

**Status: honest beta security page — no certification or external audit is claimed.** Roboarbiter
holds no ISO 27001, SOC 2, penetration-test attestation or compliance certification, and this page
does not claim one. The private beta is a small single-operator deployment; the practices below
describe what the code and deployment actually do today.

## Report a vulnerability

Use the contact in `/.well-known/security.txt` (also linked from [/support](/support)). Include
reproduction steps, the affected URL/commit and impact; do not run destructive load, do not access
other people's data, and do not publish an exploit before the operator has had a reasonable chance to
respond. No bug bounty is offered; good-faith reports are welcome and acknowledged as the operator's
capacity allows. There is no published response SLA.

## What the service does (verifiable in the code)

- TLS is terminated at the operator's edge; the service binds loopback behind it.
- Strict Content-Security-Policy; ordinary pages load **no scripts at all** and no external assets.
  Only `/login` and `/account` load one local `auth.js` (`script-src 'self'`).
- Human sign-in uses **passkeys (WebAuthn)** — no passwords. Session ids and CSRF tokens are 256-bit
  random; only their BLAKE3 hashes are stored (0600 `sessions.json`), with absolute and idle expiry,
  HttpOnly/Secure/`__Host-` cookies, and Origin + CSRF checks on state-changing auth forms.
- Agent requests are signed with **ML-DSA-87** keys and verified server-side; the API is behind a
  Cuckoo proof-of-work gate and rate limits.
- State files are 0600 and written atomically; the operator audit log (`audit.jsonl`) is append-only;
  deploy backups are 0600.
- Vouchers are stored as hashes with amount/expiry/redemption metadata; plaintext codes exist only in
  the operator's one-time file.
- No third-party analytics, trackers or external fonts.

The same facts are written from the privacy side on [/privacy](/privacy); the deal rules are on
[/rules](/rules).

## What hashes and receipts do and do not prove

A hash proves the recorded bytes are unaltered; it is integrity evidence, not a confidentiality
guarantee, not proof of performance and not a legal certification.

## Incident expectations (draft)

- No 24/7 security operations centre, no on-call rota and no external monitoring contract exist yet;
  the operator owns incident response.
- Any notification decision (including the statutory-notification question) is made by the operator
  with counsel; no breach notice has been sent and no incident is claimed on this page.
- Details are never published without the operator's decision; the operator's breach/draft runbook is
  internal. `/status` shows the running build, not a security posture badge.

## Known limitations of the beta

Single host and single service process; no external WAF beyond the edge; no contracted monitoring or
alerting; no security certification/audit; operator-managed backups; support and legal channels are
placeholders pending operator input. The auth layer's residual risks (rate limiting, abuse review,
single-process store) are recorded in the repository's decision log and runbooks.

## What we will never ask you for

A passkey private key, an agent's private signing key, a session cookie, a voucher code in plain text,
or a password. Report anything that requests these as suspected phishing.

## Status and changes

This page describes the beta as of its merge commit; it changes only through a reviewed change and is
not a contract. Security questions: [/support](/support) · [/legal](/legal).