Skip to main content
Start your 30-day trial
Trust Center

Secure by Design progress

An engineering draft of our security progress and the evidence still needed. SafeGora does not claim to have signed the CISA pledge or completed its goals through this report.

Security overview

Version 2026-11-01.1. Source reviewed 2026-11-01. This is a source inventory; it is not a deployment assessment or third-party certification.

The seven topics follow the CISA Secure by Design pledge. Source references identify the reviewed implementation and do not prove a control has operated successfully in a customer environment.

Multi-factor authentication

Goal not demonstrated

Primary authentication remains required; the reviewed policy does not require an additional MFA factor. No increase in MFA adoption is claimed.

Remaining evidence: An approved future authentication policy and measured adoption evidence are needed before claiming this goal.

Reviewed source references
  • packages/auth/src/employerPolicy.js:65–76

Default passwords

Partial source evidence

Pinned employer journeys use email-code authentication and disable password login. This is source evidence for that journey, not a product-wide default-password inventory.

Remaining evidence: Complete the account and integration inventory and observe each supported sign-in path.

Reviewed source references
  • packages/auth/src/employerPolicy.js:45–64

Vulnerability classes

Partial source evidence

The application has a token-based CSRF control and explicit route exemptions. Source existence does not demonstrate a measured reduction in vulnerability classes.

Remaining evidence: Bind current security test results and a reviewed vulnerability trend to the assessed product boundary.

Reviewed source references
  • services/api/src/middleware/csrf.js:143–150

Security patches

Partial source evidence

The repository delivery recipe orders migrations before application rollout. A delivery recipe alone does not prove patch adoption or that a particular build is serving.

Remaining evidence: Bind independent build, serving-image and release receipts, with the measured patch scope.

Reviewed source references
  • cloudbuild.yaml:1006–1019

Vulnerability disclosure

Partial source evidence

The existing security page describes coordinated disclosure and a good-faith research policy; security.txt identifies the reporting contact.

Remaining evidence: Confirm the policy owner and the delivered page and contact before treating the goal as established.

Reviewed source references
  • apps/web/src/app/security/page.tsx:100–118

Vulnerability reporting

Goal not demonstrated

The incident-response procedure is available. No CVE publication, completeness of CWE/CPE fields, or timeliness measurement is asserted by this report.

Remaining evidence: The security owner must provide any applicable vulnerability register, publication records and reporting measurements.

Reviewed source references
  • docs/security/incident-response-runbook.md:1–15

Intrusion evidence

Partial source evidence

The API exposes tenant-filtered audit listing and CSV export behind a role check. Source evidence does not prove retention, completeness, or availability to every customer.

Remaining evidence: Bind authenticated audit access, tenant isolation, completeness, retention and entitlement observations.

Reviewed source references
  • services/api/src/domains/compliance/routes/auditLog.js:1–24

Corrections and withdrawals

Report an inaccurate statement to Ollie@safegora.com. Corrections and withdrawn statements receive a new report version with a dated explanation. The earlier version remains in the source history. An unresolved or changed citation prevents this report from building; a source check never substitutes for approval or live evidence.

Version history

  • 2026-09-22.1 — 2026-09-22: Publish the seven-goal source inventory with limitations; no goal marked achieved.
  • 2026-09-27.1 — 2026-09-27: Rebind the delivery-recipe citation after reviewed producing-build signing and SBOM changes; migration-before-rollout source claim and remaining runtime evidence are unchanged.
  • 2026-09-28.1 — 2026-09-28: Rebind the unchanged migration-before-rollout source excerpt after owner-requested removal of the website publication gate. Security claims, limitations and remaining runtime evidence are unchanged.
  • 2026-09-29.1 — 2026-09-29: Rebind the unchanged migration-before-rollout source excerpt after the approved SafeGora OpenAI configuration additions. Claims, limitations and outstanding runtime evidence remain unchanged.
  • 2026-10-03.1 — 2026-10-03: Rebind the unchanged migration-before-rollout source excerpt after the owner-approved development SBOM default change. Claims, limitations and remaining runtime evidence are unchanged.
  • 2026-10-03.2 — 2026-10-03: Rebind the unchanged migration-before-rollout excerpt to proposed SafeGora OpenAI runtime substitutions, preserving the accepted SBOM default true. Draft review basis is the bound source plus its exact runtime diff. Claims, limitations and certification state remain unchanged; refresh the source anchor to the integrated candidate before publication.
  • 2026-10-03.3 — 2026-10-03: Bind this draft to ordinary source parent ee2de1ff46593ac309b9264e0469cd429371070a plus the exact proposed cloudbuild.yaml SHA256 fad30018db417c48104c531770d77c3137589ca55e4fd2e4b74c017e2f456b75. The proposed cloud bytes are not contained in reviewedSource; reviewedSource identifies the ordinary parent only. The migration-before-rollout excerpt SHA256 487df4d64b82de6c9057cc9a6fadf87e9c60a01939e798b019c6fefc1a99141a is unchanged. Seven claims, limitations, unsigned pledge and absent certification remain unchanged. No integrated build, deployed source or live release is asserted.
  • 2026-10-03.4 — 2026-10-03: Bind the seven-goal source inventory to owner-integrated candidate c2253afde9ede6d022afee2bac2b994fc8c75cf0. The cited cloudbuild.yaml bytes and migration-before-rollout excerpt now exist in reviewedSource. Claims, limitations, unsigned pledge and absent certification remain unchanged. This source inventory does not establish deployment or live acceptance.
  • 2026-10-04.1 — 2026-10-04: Rebind the unchanged migration-before-rollout source excerpt to develop 1e82504cd60c7ee3c2e2e5529f6cb1f0811ce583 after the owner-approved cloudbuild.yaml default change of the SafeGora OpenAI MCP contract substitution to v2 (merge request 8444). The excerpt SHA256 487df4d64b82de6c9057cc9a6fadf87e9c60a01939e798b019c6fefc1a99141a is unchanged. Claims, limitations, unsigned pledge and absent certification remain unchanged. No deployment or live acceptance is asserted.
  • 2026-10-08.1 — 2026-10-08: Rebind the unchanged migration-before-rollout source excerpt to develop 9122ff4596bda96c31b8e6471a2f1748dbf9290a after the shared cloudbuild.yaml timeout changed from 1800s to 2400s in commit 89ee1cb9dc. The cited lines 901 through 914 and excerpt SHA256 487df4d64b82de6c9057cc9a6fadf87e9c60a01939e798b019c6fefc1a99141a are unchanged. All seven source citations resolve against this reviewed source. Claims, limitations, unsigned pledge and absent certification remain unchanged. No deployment or live acceptance is asserted.
  • 2026-10-17.1 — 2026-10-17: Rebind the unchanged vulnerability-disclosure excerpt to apps/web/src/app/security/page.tsx lines 99 through 117 after the page added account controls and a data-location table. The disclosure wording is unchanged. Claims, limitations, unsigned pledge and absent certification remain unchanged. No deployment or live acceptance is asserted.
  • 2026-10-18.1 — 2026-10-18: Rebind the unchanged migration-before-rollout source excerpt to develop 2287cf676e5c1ccc0c668fed71cb4eca19a4041e after the owner-approved AI queue hold/config substitutions in merge request 8682. The excerpt moved from lines 901 through 914 to 903 through 916; excerpt SHA256 487df4d64b82de6c9057cc9a6fadf87e9c60a01939e798b019c6fefc1a99141a is unchanged. All seven source citations resolve against this reviewed source. Claims, limitations, unsigned pledge and absent certification remain unchanged. No deployment or live acceptance is asserted.
  • 2026-10-18.2 — 2026-10-18: Re-verify both excerpts together at 34b24c937af441c22ad07dd80aecded553209fc2. That commit contains the vulnerability-disclosure excerpt in apps/web/src/app/security/page.tsx lines 99 through 117 (file SHA256 d489b2f4bae06d16d8b2c1e9d629e7af1b1ad8078402fcff5766c0caaf912e82) and the migration-before-rollout excerpt in cloudbuild.yaml lines 903 through 916 (file SHA256 bc2129ba10dbee0f77cd015e4eb2debd0235965e2d6b8c39d9071336b031922d, excerpt SHA256 487df4d64b82de6c9057cc9a6fadf87e9c60a01939e798b019c6fefc1a99141a). Develop 2287cf676e5c1ccc0c668fed71cb4eca19a4041e does not contain the rebound security page bytes. Claims, limitations, unsigned pledge and absent certification remain unchanged. No deployment or live acceptance is asserted.
  • 2026-10-20.1 — 2026-10-20: Review the owner-approved #5649 candidate dependency: API, platform and website canaries now require actual production migration-job success as well as the retained dev/staging inline ordering. The existing source-only delivery-recipe claim remains supported; patch adoption, serving-image and release evidence remain outstanding. Bind cloudbuild.yaml lines 948 through 961, file SHA256 18107bc85ac23851f726135334f8dcd73bd1406ca99076c2d0a1cae530f31a5b, excerpt SHA256 b97d540917cac03f319cec43236c91a0c55d2c04081ded049fb98fceb166ff84. All cited source bytes are now contained in integrated source commit 4cd8f50a95b384d286cc39701b8bf67088c8877d; reviewedSource binds that commit. This report-only follow-up does not change those source inputs. All seven goal dispositions, limitations, unsigned pledge and absent certification remain unchanged; no deployment or live acceptance is asserted.
  • 2026-10-21.1 — 2026-10-21: Rebind the unchanged migration-before-rollout source excerpt after the approved shared website build step added per-document CSP script-map generation. The cloudbuild.yaml file SHA256 is 543b23a9295c50a9e5233085d98e450752f695ee4f51e181f753718be51dae5d; lines 948 through 961 and excerpt SHA256 b97d540917cac03f319cec43236c91a0c55d2c04081ded049fb98fceb166ff84 are unchanged. All seven cited source files were checked together and their exact bytes are contained in reviewedSource cd8c5762b08b90366380438c8bb5b591ea327f5e. All seven goal dispositions, remaining evidence, engineering-draft status, unsigned pledge and absent certification remain unchanged. This source correction does not assert deployment or live acceptance.
  • 2026-10-26.1 — 2026-10-26: Rebind the unchanged migration-before-rollout source excerpt after the approved mail-remediation configuration added default-off mail profile mappings and substitutions to shared cloudbuild.yaml. The excerpt moved from lines 948 through 961 to 980 through 993; excerpt SHA256 b97d540917cac03f319cec43236c91a0c55d2c04081ded049fb98fceb166ff84 is unchanged. The cloudbuild.yaml file SHA256 is d229b07fab21117ec371671c59013d45a4c450ef5f6be5cbe66650b13f7e95b2. All seven current source citations were checked together and their exact file and excerpt bytes are contained in reviewedSource 8e5a091b2e1edd477e62a47b0e9d40d439fd14a0. Goal dispositions, remaining evidence, engineering-draft status, unsigned pledge and absent certification remain unchanged. This source correction does not assert deployment or live acceptance.
  • 2026-10-27.1 — 2026-10-27: Rebind the unchanged migration-before-canary source excerpt after mail configuration changed cloudbuild.yaml. The excerpt moves to lines 982 through 995; its excerpt SHA256 is unchanged. All current source citations were checked against reviewedSource 0346895d815bf349f979d4ff4b187e59cb2e16a0. Goal dispositions, limitations, engineering-draft status, unsigned pledge and absent certification remain unchanged. This source correction does not assert deployment or live acceptance.
  • 2026-10-29.1 — 2026-10-29: Rebind the unchanged migration-before-canary excerpt after the approved website publication hold, origin guard and staging visitor source changes. Its reviewed cloudbuild.yaml excerpt is at lines 1006 through 1019, file SHA256 f2d4bacab579d57f1284dd8e7568f7aaab3d76bacb1f7bf6e450f421b81a43d8 and excerpt SHA256 b97d540917cac03f319cec43236c91a0c55d2c04081ded049fb98fceb166ff84. All seven current source citations were checked together against reviewedSource 0a038f2a242f7f8de05d0df295960f3d8d3deea5. Goal dispositions, remaining evidence, engineering-draft status, unsigned pledge and absent certification remain unchanged. This source correction does not assert deployment or live acceptance.
  • 2026-10-29.2 — 2026-10-29: Rebind the seven source citations to integrated source commit 6742ea07b382da42c9cb8e2f03eddfed73d77adf. The security page changed for legal accuracy; the unchanged coordinated-disclosure excerpt moves to lines 100 through 118, file SHA256 c8d07b3c3bca14539c6dd848221d646a2e1654eb414450bb24fabde91d5b57b1 and excerpt SHA256 a699a42a89404a10d2c839784436bc386a65ff15e82d8ce24c96bba6d0f8b5d2. All seven cited file and excerpt bytes were checked against the integrated commit. Goal dispositions, remaining evidence, engineering-draft status, unsigned pledge and absent certification remain unchanged. This source correction does not assert deployment, publication approval or live acceptance.
  • 2026-11-01.1 — 2026-11-01: Rebind the authentication-policy citations after wave 27 added email-code login for members with accepted legacy_code_v1 invitation evidence while keeping their password login disabled. The primary-authentication-only MFA claim remains supported at packages/auth/src/employerPolicy.js lines 65 through 76; the pinned employer email-code and disabled-password claim remains supported at lines 45 through 64. All seven cited file and excerpt bytes were checked together against reviewedSource 28101238b31ccf82428e4c113795242db2e48b31. Goal dispositions, remaining evidence, engineering-draft status, unsigned pledge and absent certification remain unchanged. This source correction does not assert deployment, publication approval or live acceptance.