Security and trust
We hold your unremediated criticals. That shapes every decision.
A list of known vulnerabilities in your estate, with affected-version detail, is among the most sensitive data your organisation owns. Below is what protects it, and what does not protect it yet.
In place today
Tamper-evident audit log
Every entry's hash covers the previous entry's, so removing or editing one breaks the chain from that point forward. Sequence numbers are uniquely indexed, so two writers cannot both claim the same position. Verification walks the chain and reports the first divergence rather than a pass/fail.
Authenticated workspace authorization
Protected routes and scan actions resolve the signed-in session server-side, verify workspace membership and restrict execution by role. Middleware is treated only as a convenience redirect, never as the authorization boundary.
Fail-safe composition decisions
Source outages, unsupported advisory forms and unresolved identities remain visible as unknown. Partial scans cannot use missing data to close an existing finding, and unscoped VEX statements cannot suppress unrelated products.
The application is never indexed
Every route under the platform carries noindex and nofollow directives and is disallowed in robots.txt. Only the marketing pages you are reading opt into indexing.
Data minimisation in uploads
Composition inputs contain products and versions. Binary and API audit uploads are parsed in memory, never executed or externally fetched, and are not retained after the request.
Deployment and assurance gates
Stated plainly, because you will find out anyway and it is better that you find out here.
Complete independent access-control assurance
Authentication and role enforcement are implemented, but exhaustive negative cross-tenant and role-denial tests for every route and action remain a production gate, together with an independent assessment.
Active-testing authorization and evidence
Signed scope records, fail-closed preflight and isolated managed DAST/browser adapters are implemented. Active extensions remain disabled until their specific runner, egress controls, recovery and authorized target workflows pass deployment acceptance. Implementation and local fixtures do not establish live coverage; general network and research runners remain unavailable.
Independent attestation
There is no SOC 2 report or third-party penetration test of Cidra itself. Both are prerequisites for holding another organisation's findings, and neither is complete.
Per-tenant encryption keys
MFA seeds, short-lived scan credentials and queued account notification content use authenticated field encryption. Inventory and finding fields depend on database and storage protections. Encryption keys per workspace are planned and not shipped.
Reporting a vulnerability in Cidra
Send it to security@cidra.dev. We acknowledge within one business day and will not pursue anyone acting in good faith under our disclosure policy.