Security

Security posture & responsible disclosure.

How Sunaiva Core is built, what runs where, and how to report a vulnerability.

Architecture posture

  • Local-first free tier. The 34 local Gate rules evaluate on-device with no network dependency. The smaller the surface that touches our backend, the smaller the surface to attack.
  • Fail-safe (fail-closed by default). On an internal evaluation error, local rules exit with a structured audit entry rather than silently passing. This is the v2.0 default. Opt-in fail-open is available via SUNAIVA_GATE_FAIL_OPEN_ON_ERROR=1 for evaluation environments where availability trumps enforcement.
  • Cryptographic verdicts. Triple-Gate and Ship Confidence emit signed verdicts — gate signatures, output hash and timestamp bound into a composite proof; Ship Confidence verdicts are HMAC-SHA256 signed and hash-chained.
  • Private source. Product source repositories are private. Public artifacts are BUSL-1.1 npm wrappers; MCP registry namespaces are verified by DNS-TXT.
Sunaiva has not completed a SOC 2 audit and does not claim SOC 2 certification. We describe our actual posture rather than badges we have not earned.

Responsible disclosure

If you believe you've found a security vulnerability in a Sunaiva Core product or the mcp.sunaivacore.io backend, please report it privately. Our commitments to you:

Acknowledge within 48 hours. You'll get a human reply confirming we received your report.
Triage within 7 days. We assess severity, reproduce, and tell you our planned course of action.
No public CVE until a fix ships. We coordinate disclosure timing with you and do not publish a CVE before a fix is available.

Scope

  • In scope: the published Sunaiva Core packages, the mcp.sunaivacore.io backend, and the marketing site at sunaivacore.io.
  • Out of scope: denial-of-service testing against production, social engineering of Sunaiva staff, and findings that require a compromised end-user device.

How to reach us

Send disclosures to the security contact published in our security.txt. Please include reproduction steps and the affected version. We're grateful for good-faith research and will credit you on request once a fix has shipped.