Trust and security

Limits first. This page says what Silvector does, what it does not do, and what it does not claim, with the repository files that back each statement.

The failure case we state first

An unsigned agent drives a real person's browser session: clean fingerprint, real cookies, human pace, no signature. The score is probabilistic, so the most the edge does with it is step_up, a challenge the person can pass. It never denies on behavior alone. Some of these sessions get through. That is the cost of not blocking real people. (docs/threat-model.md)

Receipts and keys

Every decision has an Ed25519-signed receipt over the canonical form of its body; changing any value in the body fails verification. Formatting and key order in transit do not matter, because verifiers rebuild the canonical form. Public keys are published at /.well-known/jwks.json, and a receipt verifies only under the key whose kid equals its agent_kid.
Staging and production signing keys are Worker secrets, never in the repository. The repository's own seed is for tests only.
Key compromise and rotation have runbooks: docs/runbook/signing-key-compromise.md and docs/runbooks/rotate-keys.md.
The published transparency head, signed live with the edge-receipt key, covers four fixed placeholder leaves and then hashes of recent receipts, appended on a best-effort basis to a per-data-center cache that keeps them for up to six hours and stops at 64 leaves. It is not a durable log, and no route shows that a given receipt is in it.

How decisions are made

decide() is a pure function: no clock, network, randomness or model inside it. A model, if one is added, may propose; a deterministic checker accepts or rejects.
Red is for deny only. Uncertain evidence leads to step_up. Unknown is never shown as red.
Edge flags are compiled into the signed policy bundle; the request path never calls a flag service.

What the public check records

POST /v1/check takes a request shape (method, path, an optional User-Agent claim). It stores the signed receipt. The receipt holds hashes of the action and policy, not the request content. These docs never send cookies, request bodies or card data, and the site sets no cookies and loads no third-party scripts.

What we do not claim

No certification. Silvector holds no SOC 2 report, ISO 27001 certificate or similar today. Controls are designed to map to SOC 2; they have not been audited.
No measured detection error rate is published yet. See the continuum guide.
No admissibility. No court has examined a Silvector record.
No named real campaign, dollar loss or regulatory conclusion. Those stay with counsel and the customer.

Supply chain

GitHub Actions are pinned by commit SHA. Rust advisories and licenses are checked with cargo-deny; npm packages are screened by Socket.
npm packages install only once they are seven days old, except a documented security fix.
SLSA Build Level 3, keyless signing and CycloneDX SBOMs are planned, not in place.

Reporting a vulnerability

Do not open a public issue. The repository's SECURITY.md describes private reporting. Its security mailbox is still awaiting confirmation, so this page does not name one yet. Remediation targets in that policy: critical within 7 days, high within 30 days.

This site

These pages are static files served by their own Worker with a strict Content Security Policy: scripts, styles, fonts and requests from this origin only. Live demos reach the API through this origin, which forwards only the public check, key set, transparency head and health routes.