ThreatFade publishes the engineering model behind its security controls and separates implemented controls from external assurance.
OIDC/JWT validation with issuer, audience, JWKS and time-claim validation; protected deployments depend on a configured identity provider.
RBAC, server-side tenant authority, tenant-scoped persistence and default-deny cross-tenant boundaries are tested in the repository.
ThreatFade preserves detection provenance and implements signed/replay-safe evidence transport and offline evidence packaging. Cryptographic integrity is not the same as proving sensor truth or causality.
The transport is bounded: local durable buffering, finite retry, idempotency and signed batches support degraded connectivity without implying unlimited offline operation.
PCAP/network inputs are treated as untrusted data with validation, bounded processing, request limits, rate controls and safe temporary-file handling.
The repository contains dependency/security scanning, SBOM, provenance/attestation, artifact signing and container-hardening gates.
Tests, benchmarks, controls and documented validation are inspectable in the source repository.
Published validation is explicitly scoped; it is not presented as a universal accuracy guarantee.
Certifications, independent testing, contractual SLAs and customer-scale guarantees require separate evidence.
| Area | Status |
|---|---|
| Authentication | IMPLEMENTED |
| Authorization | IMPLEMENTED |
| Tenant isolation | TESTED |
| Audit logging | IMPLEMENTED |
| Evidence integrity | TESTED |
| Offline/store-and-forward | TESTED |
| Dependency scanning | IMPLEMENTED |
| SBOM | IMPLEMENTED |
| Container hardening | TESTED |
| Formal certification | NOT-CLAIMED |
ThreatFade uses OWASP ASVS 5.0.0 as an application-security verification baseline and is informed by NIST CSF 2.0 for cybersecurity risk management. These are engineering references, not certification or compliance claims. AI/agent-specific OWASP guidance is relevant only where an actual AI/agent component exists; the deterministic detection engine is not presented as an autonomous AI agent.
Security vulnerabilities should be reported through the repository's published security contact and disclosure mechanism. Do not send secrets, credentials or sensitive customer data in public issues.
Open repository security page →ThreatFade does not claim SOC 2, ISO 27001, Common Criteria, regulatory approval, third-party penetration testing, independent detection validation, contractual SLAs, customer-scale performance guarantees or universal security outcomes. Those require separate operational and independent evidence.