00Trust / security policy
Security, stated plainly.
How to report a vulnerability, where Verify runs, what this website collects, and the security claims TraceAxiom does not make yet.
01Reporting
Report a suspected vulnerability without exposing the vulnerability.
Email access@traceaxiom.com with the subject “Security report”. Include a high-level description, the affected URL or component, and a safe way to contact you. Do not include exploit code, credentials, personal data, or secrets in the first message. The same route is published in /.well-known/security.txt.
TraceAxiom will reply to set up a more suitable private channel when one is needed. There is no bug-bounty program and no response-time promise today. Please act in good faith, avoid privacy violations and service disruption, and allow reasonable time to investigate before public disclosure.
- Stable route in security.txt
- No secrets in the first message
- Good-faith reports welcomed
- No bug bounty or response-time promise
02Where Verify runs
Verify is a GitHub Action, so it runs in your own CI.
An Action runs on the CI runners of the repository that installs it, not on a TraceAxiom server, and Verify checks out and tests the pull request there. On GitHub's runners the pull request's code runs as a separate user, and before each run Verify checks that this user cannot read the repository's git credentials, the event that started the run, or Verify's own files.
Verify is not installable yet. Before it is, the install documentation will state exactly which repository permissions the Action asks for and why. Until that documentation exists, this page makes no claim about them.
- Runs on the installing repository's runners
- Pull request code runs as a separate user
- Not installable yet
- Permissions documented before install
03Website data
The website collects only what the design-partner form needs.
The site has no advertising pixels or behavior-tracking scripts. A design-partner request contains the fields a visitor submits, plus a salted hash of the request IP address and a bounded user-agent string for abuse prevention. The privacy notice names each service provider and its purpose.
Do not put credentials, secrets, regulated data or confidential source code in the form. It is a sign-up, not a channel for code.
- Vercel hosts the site and form function
- Supabase stores requests
- Resend sends the confirmation
- No advertising or behavior tracking
04Not claimed
Security claims stop where independent authority stops.
TraceAxiom has not completed an independent external security assessment and holds no security certification. Nothing on this site should be read as either.
The website's own release gate checks the build, browsers, accessibility, crawler visibility and discovery files, and publishes the result on the release record. That record covers the website only.
- No independent assessment yet
- No certification claimed
- Website release record is public
Design partners
Want Verify on your repositories?
Verify is not installable yet. Join the waitlist to hear the day it is. Teams whose pull requests come from coding agents can also become design partners and use it first.
Join the waitlist