The platform is aligned to NIST Cybersecurity Framework 2.0 and the ASD Essential Eight. Autonomous scanning runs every night. Every credential is vaulted. Every AI output carries a forensic audit trail.
We align to internationally recognised security frameworks — not bespoke checklists. This gives clients a common language for assessing posture and comparing providers.
Security is not a checklist item — it is built into every layer of the platform architecture, from credential storage to AI output governance.
The security scanner runs as an isolated agent at 03:00 AEST. It auto-fixes what it can, kills rogue services it detects, and sends an alert only if it finds something that requires attention. If everything is clean, it logs silently and stops.
All security findings are documented with severity, status, and remediation detail. Nothing is marked resolved without verification.
| Date | Finding | Severity | Status | Remediation |
|---|---|---|---|---|
| 22 Apr 2026 | Android Control Service — no authentication on 20 endpoints including shell execution and device control. World-open on port 8765. | Critical | ✓ Fixed | X-API-Key header auth added at app level. Key stored in secret vault. |
| 22 Apr 2026 | /tmp HTTP server running since Apr 20 — serving entire /tmp directory (incl. OAuth codes) world-open on port 8877. | Critical | ✓ Fixed | Process killed. Scanner now detects and kills rogue servers automatically. |
| 22 Apr 2026 | Cloudflare tunnel token exposed as CLI argument — visible in process list to any local process. | Critical | ✓ Fixed | Systemd unit rewritten to load token from EnvironmentFile. Token no longer in process list. |
| 22 Apr 2026 | Four secret files with 664 permissions (world-readable). | High | ✓ Fixed | All enforced to 600. Scanner auto-corrects permission drift on every run. |
| 22 Apr 2026 | Pollster Portal CORS configured with wildcard origin and credentials=True. | High | ✓ Fixed | Replaced with explicit allowed origins list. |
| 22 Apr 2026 | JWT secret ephemeral — regenerated on every process restart, invalidating all sessions. | High | ✓ Fixed | JWT secret persisted to secret vault. Loaded at startup consistently. |
| 22 Apr 2026 | Prometheus and observability metrics exposed world-open without authentication. | Medium | Accepted | Acceptable within Tailscale network boundary. Flagged for hardening if external access ever enabled. |
Three documented response playbooks. Each is designed to be executed immediately without waiting for judgement calls under pressure.
All credentials are on a documented rotation schedule. High-value credentials rotate more frequently.
Every exported briefing carries an invisible mark — not a watermark you can see and remove, but a fingerprint woven into the encoding of the document itself. If it leaks, we know exactly who had it.
Every exported briefing is encoded with a unique recipient identifier embedded in Unicode variation selectors, zero-width characters, and subtle whitespace patterns distributed throughout the document. The encoding is invisible in rendering but survives virtually all document transformations — including printing, scanning, and OCR re-digitisation.
Each encoding maps to a specific delivery record in the attribution ledger: the recipient, the timestamp, the scenario reference, the governance status at time of export, and the document version. When a leaked document is recovered — from a screenshot, a forwarded email, a scanned print, or a published excerpt — the platform extracts the fingerprint and identifies the source within seconds.
The 2M+ unique ID space means every individual delivery across the platform's entire client base carries a distinct fingerprint — no recycled IDs, no collisions.
Uses Unicode homoglyphs, variation selectors, and systematic zero-width joiner placement — indistinguishable in any rendered view. Survives email reformatting, PDF extraction, and OCR quantisation. The encoding scheme is proprietary and the mapping ledger is stored locally, not in any cloud service.
Campaign-level strategy documents distributed to senior staff, advisers, or principal offices. Any situation where a briefing circulates among more than one person and its contents could damage a campaign if published.
Research products that would be damaging if leaked to the subject. Knowing a copy reached a specific adviser allows rapid containment before exposure.
Negotiation positions, offer frameworks, and internal assessments shared with coalition partners. The Canary Protocol allows post-hoc attribution even when physical copies are involved.