From d5333a590a9c9e77ff93010f5062f5c0b8f5eb14 Mon Sep 17 00:00:00 2001 From: wshallwshall Date: Fri, 31 Jul 2026 18:48:16 -0500 Subject: [PATCH] Security: state what dynamic testing actually runs, and what still doesn't security.html:110 said "Dynamic application security testing (DAST) has not been performed". That was true when PR #97 wrote it this morning. It is not true now: the engine merged an authenticated authorization sweep that drives a live instance over a real loopback socket, and it runs in the required test legs on every build. Leaving the flat denial would be the same defect PR #97 corrected, pointed the other way -- #97 replaced an overstatement ("with dynamic testing per release", asserted while nothing had ever run) with a denial that the merge has now falsified. The page has been wrong in both directions; this is the wording that survives movement in either. Scopes the "not performed" claim to INDEPENDENT, which is the distinction the project's own standard already draws and the site had flattened: secure-development-standards.md:425 -- "Independent ASVS-L3 review & DAST ... Not yet performed; a dated risk acceptance is in force pre-1.0." :191 -- ASVS-L3 verification "may be performed internally; the external engagement adds independence + credibility." So this is the site catching up to a published document, not a new hedge. Also names what the sweep does NOT cover -- the non-HTTP ingress listeners, the browser console, TLS -- so "authorization sweep" cannot be read as full dynamic coverage, and cannot be walked back into #97's overstatement by a later edit. Verified this is the only affected surface. The FAQ and its FAQPage JSON-LD (:374, :422) say "independent external code review or penetration test" and carry no DAST claim, so they remain true and are untouched. The four doc sources that mention DAST already hedge with "independent" and need no change. No citation of the engine ADR: it is a first-party source and now public, but linking implementation detail from a marketing page is a separate editorial call for the owner. Co-Authored-By: Claude Opus 5 --- security.html | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/security.html b/security.html index 8b6c0e4..ce70023 100644 --- a/security.html +++ b/security.html @@ -107,7 +107,7 @@

NIST SSDF — built securely

NIST 800-115 — tested in CI

-

Security testing follows NIST SP 800-115: automated SAST, software-composition analysis, and secret-scanning on every build, plus a full functional and integration suite exercised against the running engine. Dynamic application security testing (DAST) has not been performed, and neither has an independent external review or penetration test — both are planned after Early Access.

+

Security testing follows NIST SP 800-115: automated SAST, software-composition analysis, and secret-scanning on every build, plus a full functional and integration suite exercised against the running engine. Dynamic testing is limited to an automated authorization sweep — on every build, a live instance is probed over a real network socket to confirm that gated endpoints refuse unauthenticated and under-privileged callers. It does not cover the non-HTTP ingress listeners, the browser console, or TLS, and no independent DAST, external code review, or penetration test has been performed — all planned after Early Access.

NIST 800-66 Rev. 2 — HIPAA-mapped