Security & trust

How the platform is being built

• Role-based clearance checks on API routes, with bearer-key validation.
• Rate limiting on the main API.
• Append-mode JSONL audit logging.
• HSTS and a Content Security Policy on the web interface.
• SBOM generation (CycloneDX and SPDX) in the air-gap bundle build.
• SHA-256 checksum and signature verification at install.
• Read-only container filesystem where configured.

These describe the code as it stands during development. They are not certifications, and no SOC 2 or ISO certification is claimed.

Rules we work by

• Defence only: no state or military weaponisation.
• Scope before work.
• Local or forked reproduction; no production testing without authorisation.
• No denial-of-service against shared infrastructure.
• Coordinated disclosure only. No public zero-day drops.
• Scanner output alone is not a report.

Responsible disclosure

If you find a vulnerability in Sovereign Hive software or this website, please report it privately. Email duaynegregg@sovereignhivesecurity.com.au (also listed in security.txt). Please do not disclose publicly until we have had a chance to fix it.

Privacy

This site sets no cookies, loads no third-party scripts and uses no analytics. Privacy practices for the platform follow the Australian Privacy Principles; the full policy will be published before launch.