Security

How CRA Sentinel is built

CRA Sentinel holds a description of the software you ship and a record of the decisions your team made about it. Both are sensitive. This page describes the controls that exist today — not intentions, and not certifications.

Get started Talk to us

Controls

Eight things, all of them implemented

Password security

Passwords are hashed with Argon2 and are never stored in a form from which they can be recovered. A minimum length is enforced, and the field is bounded so an unbounded input cannot be used to make the server do work.

Session cookies

Browser sessions use an opaque token in an HttpOnly cookie, marked Secure outside development and set to SameSite=Lax. The Secure flag follows the deployment environment and nothing else, so it cannot be downgraded by influencing a request header.

CSRF protection

State-changing requests carry cross-site request forgery protection. Billing administration is covered by it too: an owner without a valid token is refused.

Organisation isolation

Every record belongs to exactly one organisation, and every request is authorised against the organisation it names. One customer cannot read another's products, findings, evidence or billing state.

Private document storage

Uploaded SBOMs are held in a private object store. The bucket is not public, no public ACL is set on upload, and the documents are not served from a publicly addressable URL.

Signed provider webhooks

Inbound webhooks are verified before they are acted on — Stripe events through Stripe's own signature verification, and email delivery events through their signed-delivery scheme. An unsigned or wrongly signed request is rejected and nothing is persisted from it.

Evidence-chain integrity

Evidence entries are append-only and hash-chained: each entry commits to the one before it, so an altered or removed entry breaks the chain and is detectable when the history is exported and verified.

Backup restore verification

Backups are not assumed to work. Restores are exercised and verified against the application schema and the evidence chains, so a recovery point is known to be usable rather than merely known to exist.

A deliberate refusal

Machine keys cannot make human decisions

API keys can automate ingest and reads. They are refused for the triage and reporting decisions the product attributes to a named person, and that refusal is enforced by the server rather than by omitting a button from an interface.

This is a security property and an evidential one. A record that says a person assessed a vulnerability should not be producible by a script holding a key.

What this page is not

These controls describe how CRA Sentinel is currently built. They are not a third-party certification or guarantee that security incidents are impossible.

CRA Sentinel does not hold SOC 2 attestation, ISO 27001 certification, a third-party penetration-test certificate, or any other external security audit, and this page does not claim any of them. If that changes, it will be stated here with the issuing body and date.