Security and trust
We hold your unremediated criticals. That shapes every decision.
A list of known vulnerabilities in your estate, with affected-version detail, is among the most sensitive data your organisation owns. Below is what protects it, and what does not protect it yet.
In place today
Tamper-evident audit log
Every entry's hash covers the previous entry's, so removing or editing one breaks the chain from that point forward. Sequence numbers are uniquely indexed, so two writers cannot both claim the same position. Verification walks the chain and reports the first divergence rather than a pass/fail.
Workspace-partitioned records
Tenant-scoped records carry a workspace identifier directly. This reduces query mistakes but is not an authorization boundary until authenticated membership and permission checks are enforced at the request layer.
Fail-safe composition decisions
Source outages, unsupported advisory forms and unresolved identities remain visible as unknown. Partial scans cannot use missing data to close an existing finding, and unscoped VEX statements cannot suppress unrelated products.
The application is never indexed
Every route under the platform carries noindex and nofollow directives and is disallowed in robots.txt. Only the marketing pages you are reading opt into indexing.
Data minimisation in uploads
An inventory is products and versions. Cidra does not ask for credentials, network access or source code, because it does not need them.
Not built yet
Stated plainly, because you will find out anyway and it is better that you find out here.
Authentication
No request-layer authentication or workspace membership check is enforced yet. A caller-chosen workspace slug is not authorization. Do not expose a deployment to an untrusted network until this critical release blocker is closed.
Active-testing authorization and evidence
Signed scope records, target verification state and a fail-closed operator preflight are implemented as a control foundation. Request authentication, ownership-proof workflows and isolated penetration-testing, black-box and research runners are not implemented; these modules must not be marketed or operated as live executors.
Independent attestation
There is no SOC 2 report or third-party penetration test of Cidra itself. Both are prerequisites for holding another organisation's findings, and neither is complete.
Per-tenant encryption keys
Encryption at rest today is whatever the underlying database provides. Envelope encryption per workspace is planned and not shipped.
Reporting a vulnerability in Cidra
Send it to security@cidra.dev. We acknowledge within one business day and will not pursue anyone acting in good faith under our disclosure policy.