Enforce trust server-side
Authorization and tenant isolation do not depend on hidden UI controls.
Security and trust
Protecting the inventory that explains your exposure.
A company’s technology inventory is sensitive operational data. VulnTrust is designed to keep tenant boundaries, authentication, auditability, and recoverability explicit—not implied.
Keep evidence visible
Security decisions remain tied to their source and application context.
Preserve human authority
Analysts own workflow and risk decisions; automation supports the process.
Current platform controls
Security mechanisms present in the codebase today.
We state implemented controls directly and do not claim certifications or independent audits that have not been completed.
Tenant-scoped authorization
Customer-owned API queries resolve through an active organization membership. An organization selector never replaces the server-side check.
Protected browser sessions
Access and rotating refresh JWTs are stored in HttpOnly cookies. Cookie-authenticated mutations require CSRF validation.
Separated security keys
Production requires separate Django, JWT-signing, and TOTP-encryption keys supplied outside the codebase.
Multi-factor authentication
TOTP enrollment, one-use login challenges, hashed recovery codes, and encrypted TOTP secrets are implemented server-side.
Auditable activity
Security-relevant actions can record actor, organization, target, IP address, request ID, user agent, and structured metadata.
Recoverable processing
Source leases, idempotency keys, durable records, retry controls, and stale-worker recovery reduce duplicate and partial side effects.
Private application services
The deployed database and Redis are not published as public application endpoints; the gateway exposes only web and API traffic.
Bounded AI authority
AI is not authoritative for vulnerability identity, applicability, severity, finding state, or alert delivery, and provider keys stay server-side.
Controlled inventory ingestion
Uploads are size- and format-limited, originals are not retained, ambiguous rows require review, and committed items preserve source provenance.
Explicit external lookup
Package URL and version queries to public OSV are disabled per organization until an authorized administrator opts in.
Data handling
Minimize access, preserve provenance, and make changes traceable.
VulnTrust separates customer inventory from shared vulnerability intelligence. Customer-specific OSV query coordinates remain only in the tenant-scoped finding evidence that needs them; shared advisory responses do not expose those coordinates. Reports are delivered through authenticated, organization-scoped endpoints.
- Customer scope
- Organization, memberships, inventory, contacts, policy, findings, alerts, and reports
- Shared intelligence
- Normalized vulnerabilities, affected-product rules, public-source records, and source health
- Authentication
- Password, TOTP when required, one-time recovery codes, short access token, rotating refresh token
- Audit context
- Actor, organization, action, target, IP, user agent, request ID, timestamp, metadata
Have a security question or found a potential issue?
Contact the VulnTrust team with enough detail for us to understand and respond. Please do not include customer data, credentials, or active exploit material in the first message.
Security review
Evaluate VulnTrust against your requirements.
We’ll walk through architecture, tenant isolation, authentication, data flow, deployment controls, and the security work required for your production rollout.