Security at Secure Raven
Closed on our side. Open about it.
How Secure Raven protects your data and its own systems: what we hold, what we never hold, the controls in front of both, and how to report a vulnerability.
- Signed request from a probe or API keyAccepted
It passes TLS, the Ed25519 signature check and its key’s scope, then reaches tenant data.
- Unsigned, replayed or altered requestRejected
It passes TLS, then fails the Ed25519 signature check and is rejected.
- Anon key, straight to the databaseDenied
It passes TLS, then meets a database that grants the anon key nothing, and is denied.
- Signed in, asking for another tenant’s rows0 rows
It passes TLS and the session check, then row-level security returns no rows.
- Privileged action without a fresh codeCode required
It passes TLS and the session check, then needs an authenticator code from the last 5 minutes.
- From your database
- Table names, policy names and flags. Never your rows.
- For each probe
- A token hash and an Ed25519 public key. No database password.
- Signed requests
- Probe and API requests carry an Ed25519 signature. We keep only public keys.
- Report to
- security@secureraven.app · security.txt
Why Secure Raven stands out
Eight differences you can check.
Each one is a property of the product, not a promise about it. The line under each point is where it shows.
- Outside in
Proof, not a checklist
If your site ships a Supabase anon key in its JavaScript, Web Surface finds it and asks your REST API how many rows that key can count. It sends limit=0, discards the response body unread, and keeps only the table name, the status and the count.
GET /rest/v1/<table>?limit=0 → count only - Fail closed
No false green
In a full database inspection, a stage that cannot finish is reported as incomplete, never as a pass, and the stages after it are skipped.
02 failed → 03 skipped → incomplete - Deterministic
Fixed rules, fixed order
All 13 Ravens are built on fixed rules, and a full inspection always runs Connect, then Static posture, then Detector. No AI model reads your data, and findings, events and credentials are never sent to an AI vendor.
13 Ravens · 3 stages · 0 AI vendors - Data minimal
Names and flags, never rows
Secure Raven stores table names, policy names and flags. It never stores your rows.
rows stored: 0 - Push probe
No database password
A small probe in your own database pushes signed telemetry. Secure Raven keeps a hash of its token and its Ed25519 public key, never your database password.
held: token hash + public key - Out of band
Not in your traffic path
No proxy and no WAF sits between you and your users. Shield, if you install it, runs in your own app and database.
proxy: none · WAF: none - Evidence
Evidence an auditor can read
HIPAA Hawk cites the Security Rule section for every check, and every privileged action lands in an append-only, hash-chained audit log. Never sold as a certification.
45 CFR 164.312(b) · hash-chained - In public
Radical honesty
A machine-readable trust manifest where every certification field is false, and a written list of the claims we do not make.
GET /api/trust/manifest → false
Private early access
- Web RavensWeb Headers, Web Surface and Login Flow run in production today.
- Database RavensIncluding HIPAA Hawk. They do not run for customers yet.
- Network RavensNetwork Telemetry and Wi-Fi Telemetry. They do not run for customers yet.
How we secure Secure Raven
The controls behind the claims.
What we hold, what we never hold, and each control with the value it runs at. Every row is live on Secure Raven today.
Push-probe mode
custodyHeld by Secure Raven
- Table names, policy names and flags.
- A hash of the probe’s token and its Ed25519 public key.
Never stored, never sent
- Your rows.
- Your database password, in push-probe mode.
- Findings, events and credentials, to any AI vendor.
15 controls · live today
Transport
- Encryption in transit
HSTS max-age=31536000- Every page and API call is served over TLS 1.2 or later. Each response carries HSTS, and every .app domain is on the browsers’ HSTS preload list.
- Browser policy
frame-ancestors 'none'- A Content-Security-Policy loads no third-party scripts, fonts or images, and no other site can frame these pages.
- Database connections
SSL required- The app reaches its database only through Supabase’s HTTPS APIs, over TLS 1.2 or later, and the database refuses connections that do not use SSL.
Identity
- Signed requests
Ed25519 · public keys only- Probe and API requests are signed with Ed25519 over the method, path, timestamp, nonce, content type, body digest and token id. We store each token’s public key and a hash of its bearer, so no shared signing secret exists on our side. Unsigned, stale, replayed, altered and revoked requests are rejected.
- Step-up
TOTP · 5-min step-up- Owners and admins confirm with an authenticator code from the last 5 minutes before they connect or delete a source, store a credential, authorize a scan, turn Watch or Shield on or off, change a role, edit the BAA inventory or mint an API key. SMS and phone factors are refused.
- Recovery codes
HMAC-SHA256- 10 single-use codes, stored as keyed hashes. Removing an authenticator takes an unused recovery code, not a password.
- Sessions
12 h · 8 h idle- A session ends after 12 hours, or after 8 hours without activity.
Access
- Tenant isolation
RLS · every tenant table- Row-level security on every tenant table, with cross-tenant isolation tests that run against a fresh database.
- Closed by default
anon: no grants- The public anon key cannot run any database function or read any table. Privileged functions answer to the server only, and new tables and functions start closed.
Data and keys
- Encryption at rest
AES-256- Our providers’ disks are encrypted with AES-256. Backups run daily, and the last seven are kept.
- Stored credentials
off in production- Storing database credentials stays off in production until an external key service holds the encryption key. When it is on, each credential is sealed with AES-256-GCM envelope encryption bound to your tenant and source, and only an isolated broker service can decrypt it.
- Keys kept apart
production only- Production secrets are set only in the production environment, never in preview builds, and never in the database.
- No AI vendor
AI vendors: 0- Findings, events, credentials and the audit log are never sent to an AI vendor.
Record
- Audit log
append-only · hash-chained- Each privileged action is appended to your tenant’s hash-chained audit log, and we do not delete it. Entries keep keyed hashes, never raw IP addresses, and only owners and admins can read the log.
On your systems
- Safe checks only
public addresses only- In production, Ravens never exploit a flaw, guess a password or run a destructive action. Web checks fetch public HTTP(S) addresses only: private network ranges are refused, and every redirect is checked again.
Where we are
What we have not done yet.
Written down, so you can hold us to it. Most of it is in the trust manifest too, in machine-readable form.
- SOC 2Not audited
Our Type I target scope is Security and Confidentiality. No auditor is engaged yet.
SOC 2 status - Penetration testNot commissioned
The scope is written. No external test has been run, so no report exists.
Claims we do not make - Release gates0 of 5 open
Every gate in the trust manifest, from safe beta to regulated data, is closed in production.
Release gates - HIPAANo certification
No one is “HIPAA certified”, including us. HIPAA Hawk maps technical safeguards; it does not certify.
HIPAA Hawk - Bug bountyNot yet
There is no paid program. We credit the people who report to us.
Disclosure policy
Vulnerability disclosure
Found a flaw? Tell us first.
Send it to the address below, the one /.well-known/security.txt publishes. This section is the policy that file points to.
Report to
security@secureraven.appPlease include
- A clear description of the issue.
- Steps to reproduce: commands, screenshots or a small proof of concept.
- The impact you believe it has.
- Affected URLs, accounts or tenant identifiers.
Please leave out
- Health information about real people.
- Real credentials or customer data.
We have not published a PGP key yet. Plain-text email is fine, and we will not hold it against you. DNS or certificate problems on our domains, leaked Secure Raven credentials and phishing that impersonates us are welcome at the same address, even where they fall outside the scope below.
Contact: mailto:security@secureraven.app
Expires: 2027-09-17T22:57:38.378Z
Policy: https://secureraven.app/security#disclosure
Preferred-Languages: en
Canonical: https://secureraven.app/.well-known/security.txt
What we promise
our response clock- Day 0You reportEmail us the issue, the steps to reproduce it and the impact you see.
- Within 1 business dayWe acknowledgeWe confirm that we have your report.
- Within 3 business daysWe triageWe aim to reproduce it and assign a severity.
- Within 5 business daysWe set a fix dateYou get our severity assessment and a target fix date.
- Within 90 daysWe fixHigh and critical issues are fixed within 90 days, sooner if one is being exploited.
- CoordinatedWe disclose togetherBy default 90 days after we acknowledge, with credit to you unless you ask us not to.
In scope
- secureraven.app: the dashboard, this site and everything under /api/.
- Our Supabase Edge Functions events-ingest, shield-ingest and evidence-export, and the sign-in callbacks, including /auth/olyron/callback.
- The probe we ship and its install flow. The customer project it runs in is not ours to test.
Out of scope
- The Supabase and Vercel platforms themselves. Report those to Supabase or Vercel.
- Customer projects where the probe is installed. They belong to our customers.
- Look-alike domains, including a .com version of our name that belongs to an unrelated company. Do not test them or send reports there.
- Third-party services we use but do not control.
- Social engineering of our staff, suppliers or customers, and physical attacks.
- Denial-of-service testing, unless we arranged it with you first.
- Reports that need physical access to a victim’s device, or a rooted or jailbroken device.
You may
- Test with your own accounts, on a staging tenant if we gave you one.
- Run automated scanners at no more than 5 requests per second per host.
- Inspect and decompile our client bundles.
You may not
- Access another customer’s data. If a flaw shows you any, stop, keep nothing and tell us.
- Run destructive commands, or persist beyond what you need to show the issue.
- Take, change, delete or move more data than you need to show the issue.
- Disclose before the coordinated date.
- Brute-force, stuff credentials or spray passwords against real users.
Safe harbor
If you follow this policy in good faith, we consider your research authorized, and we will not pursue legal action against you for it under the Computer Fraud and Abuse Act, the Digital Millennium Copyright Act or similar laws. If a third party brings a claim, we will make a good-faith effort to show that your research was authorized. Not sure something is in scope? Ask first: we answer scope questions within 1 business day.
Credit
We do not run a paid bug bounty yet. We credit reporters in the changelog, unless they ask to stay anonymous.
Questions before you connect anything?
Secure Raven is in private early access. The trust center lists our subprocessors, and reads retention and release gates straight from the trust manifest.