Security and trust
We hold your unremediated criticals. That shapes every decision.
A list of known vulnerabilities in your estate, with affected-version detail, is among the most sensitive data your organisation owns. Below is what protects it, and what does not protect it yet.
In place today
Tamper-evident audit log
Every entry's hash covers the previous entry's, so removing or editing one breaks the chain from that point forward. Sequence numbers are uniquely indexed, so two writers cannot both claim the same position. Verification walks the chain and reports the first divergence rather than a pass/fail.
Authenticated workspace authorization
Protected routes and scan actions resolve the signed-in session server-side, verify workspace membership and restrict execution by role. Middleware is treated only as a convenience redirect, never as the authorization boundary.
Fail-safe composition decisions
Source outages, unsupported advisory forms and unresolved identities remain visible as unknown. Partial scans cannot use missing data to close an existing finding, and unscoped VEX statements cannot suppress unrelated products.
The application is never indexed
Every route under the platform carries noindex and nofollow directives and is disallowed in robots.txt. Only the marketing pages you are reading opt into indexing.
Data minimisation in uploads
Composition inputs contain products and versions. Binary and API audit uploads are parsed in memory, never executed or externally fetched, and are not retained after the request.
Not built yet
Stated plainly, because you will find out anyway and it is better that you find out here.
Complete independent access-control assurance
Authentication and role enforcement are implemented, but exhaustive negative cross-tenant and role-denial tests for every route and action remain a production gate, together with an independent assessment.
Active-testing authorization and evidence
Signed scope records, target verification state and fail-closed preflight are implemented. Automated ownership proof and isolated active DAST, network, black-box and research runners are not; these capabilities are not counted as live execution.
Independent attestation
There is no SOC 2 report or third-party penetration test of Cidra itself. Both are prerequisites for holding another organisation's findings, and neither is complete.
Per-tenant encryption keys
Encryption at rest today is whatever the underlying database provides. Envelope encryption per workspace is planned and not shipped.
Reporting a vulnerability in Cidra
Send it to security@cidra.dev. We acknowledge within one business day and will not pursue anyone acting in good faith under our disclosure policy.