Public disclosure status
No monitored inboxNo monitored public security address is configured in this build, so this page does not claim an active intake channel.
Security disclosure · Not launch-ready
Security
The product has significant hardening work already, but no monitored public disclosure operation is configured for this beta. Do not send secrets, provider credentials, payment details, or private customer data through this unpublished path.
True blockers
Operations still requiredMFA, least privilege, secret rotation, monitored reporting, incident playbooks, and zero open critical/high findings remain required before launch claims.
What this page can state honestly today
- No public bug bounty, PGP key, or monitored disclosure inbox is claimed by this credential-free scaffold.
- Do not send secrets, provider credentials, payment details, or private customer data through an unpublished support path.
- Independent security review, incident drills, release revocation, and monitored disclosure operations remain pre-launch requirements.
The customer platform plan also requires cross-account review, CSRF/XSS/CSP abuse testing, release-revocation drills, and an independent security review before the security program can be described as ready.
Disclosure intake unavailable
No monitored security mailbox is configured for this beta. The disclosure intake stays disabled until triage, acknowledgement, and escalation workflows are ready.