We publish our security posture openly — internal red-team results, CVE history, architecture controls, and SOC 2 progress. No marketing spin. Just the numbers.
Numbers an attacker has to defeat, not adjectives we picked for marketing.
An internal red-team self-assessment, April 2026. No third-party penetration test has been done yet. Every finding below is fixed and has a regression test in the repository.
None found
Each fix has a regression test
Each fix has a regression test
Audit hash chain forgeable without a key
Disposition: Genesis and entry hashes are HMAC-keyed per deployment. Regression test: backend/tests/unit/test_hash_chain_service_coverage.py
Code execution via a crafted ML model file (pickle)
Disposition: Restricted unpickler, and no model loads without its SHA-256 file. Regression test: backend/tests/modules/services/ai_business_logic/test_ml_detector.py
JWT replay from a different client
Disposition: Tokens carry client IP and user-agent hashes; strict mode refuses a mismatch. Regression test: backend/tests/security/test_device_binding.py
MCP transitive permission bypass
Disposition: The tool-call graph refuses a chain that reaches a tool the session was never granted. Regression test: backend/tests/modules/mcp/test_tool_call_graph_extra.py
Prompt injection split across requests
Disposition: Fragments are correlated per client across requests. Regression test: backend/tests/agentic/test_prompt_security.py
ReDoS in the HTML-comment threat pattern
Disposition: Bounded quantifiers; a 50,000-character pathological input completes in under 20 ms. Regression test: backend/tests/unit/threat_detection/test_pattern_loader.py
WebSocket rate limiter trusted X-Forwarded-For from any client
Disposition: X-Forwarded-For is honoured only from TRUSTED_PROXY_IPS. Regression test: backend/tests/middleware/test_client_ip_extra.py
The full internal red-team write-up is in the data room and available to prospects on request. Request report →
Detection is scored on a frozen 2,580-sample held-out set it was never trained on: 0.788 recall, 0.857 precision, 3.12% false-positive rate. The test lives at backend/tests/security/test_detector_heldout_external.py and fails the build on any regression.
Most SaaS security is checkbox compliance — bolted on after the fact. G8KEPR built security into the core architecture from day one.
A breach must defeat every layer independently. Each layer is operated and verified separately — there is no single point of failure.
TLS 1.2+ terminated by nginx; the application listens on localhost only
926 OWASP Core Rule Set rules active — blocks SQLi, XSS, RCE, path traversal
Rate limiting, JWT validation, scoped API keys, circuit breakers, MCP sandbox
PostgreSQL row-level security enforces tenant isolation at the DB layer
Each card says what the capability does on a default install: whether it blocks, only records, or waits for you to switch it on.
Rug-pull detection. Tool definitions hashed at tools/list time, re-verified on every tools/call. A malicious MCP server cannot silently swap a safe tool for a malicious one mid-session.
modules/mcp/tool_registry.pyStatistical baselines per provider per hour-of-day, not static thresholds. 4 rolling windows. Progressive recovery 10/25/50/100%. Off by default; enable with ADAPTIVE_CB_ENABLED.
gateway/router.pyAll four pillars publish findings to one internal threat event bus, and a correlator scores the ones that occur together into incidents. Today it joins findings that share a correlation ID.
modules/compound_correlator/Every security event written to append-only audit storage with SHA-256 integrity verification. Three verification levels (full, single entry, last-N). Tampering breaks downstream hashes.
SHA-256 integrityVerified against SSL Labs, securityheaders.com, and Mozilla Observatory. TLS 1.2 and 1.3 only — TLS 1.0 and 1.1 are not offered. All headers are enforced server-side, not just report-only.
Concrete primitives, not vague "industry-standard" promises. Algorithm choices match OWASP 2024 guidance.
HSTS preload · mTLS between sensor and collector
Application-level encryption for API keys, OAuth secrets, TOTP, webhooks, MCP secrets
Per OWASP 2024 password storage guidance · 256-bit output
Timing-safe comparisons via hmac.compare_digest() everywhere
DB access alone cannot forge an entry · genesis block derived from the key itself
Prefix in transit · SHA-256 hash at rest · timing-safe lookup
Decryption keeps previous key as fallback · zero-downtime rotation
Envelope encryption · KEK in KMS or HashiCorp Vault · per-record DEK
pip-audit + npm audit run as blocking CI gates on every pull request
No critical dependency vulnerabilities found in project lifetime
Next.js CVE-2025-29927 — header bypass. Patched same day, before any production traffic was routed
Automated alerts fire when a new CVE matches a pinned dependency version
SAST · Python + TypeScript
Python security linting
Container CVE scanning
Python dependency CVEs
Node dependency CVEs
Dynamic AppSec testing
Secret detection in git
Custom-rule SAST
Every PR runs all eight. Build fails on any new finding. TruffleHog scans every commit for accidentally committed credentials. SBOM diff is generated on every release.
All technical controls are implemented and independently verifiable. We are not SOC 2 certified — we say so plainly. External auditor engagement is scheduled H2 2026. We disclose our actual status, not a vaporware claim.
Found a vulnerability? We want to hear from you. Report privately to security@g8kepr.com and we will acknowledge within 24 hours with an initial severity assessment and remediation timeline.
Report privately
Email security@g8kepr.com — description, reproduction steps, and impact. PGP-encrypted reports welcome.
We acknowledge within 24h
You receive confirmation and an initial severity assessment. We commit to a remediation timeline.
We patch and keep you updated
P1/P2 issues are patched before public disclosure. We will keep you in the loop on progress.
Coordinated public disclosure
We work with you on timing and credit for public disclosure after the fix is deployed and verified.
Defined runbooks for every severity level — DR drills run quarterly
We publish our posture because we have nothing to hide. Need the full red-team write-up, an architecture review session, or a call with our security team — reach out.