Security
Last updated 2026-09-01 · Every number on this page was measured, and says where you can measure it too.
Security pages are usually written in adjectives — words that sound reassuring and that no reader can check, no competitor can be held to, and no auditor can fail you on. This one is written the other way round: the specific control, the specific place it is enforced, the specific value actually served, and the specific thing it does not yet cover.
1. Encryption and transport
| Control | The specific value | Check it yourself |
|---|---|---|
| HTTPS only | Every Avieros hostname is served over TLS. There is no plaintext listener to downgrade to. | Any Avieros URL over http:// redirects to https://. |
| HSTS | max-age=63072000; includeSubDomains; preload — two years, every subdomain, preload-eligible. After one visit a browser refuses to speak plaintext to Avieros at all. |
curl -sI https://trust.avieros.com | grep -i strict-transport |
| Content-Security-Policy on this site | default-src 'none' with no script-src at all. Not 'self' — absent. No script can execute on the Trust Center, including one an attacker manages to inject. |
Same header dump. If you ever see unsafe-inline here, that is a regression and worth reporting. |
| The other response headers | X-Content-Type-Options: nosniff, X-Frame-Options: DENY with frame-ancestors 'none', Referrer-Policy: strict-origin-when-cross-origin, Cross-Origin-Opener-Policy: same-origin, and a Permissions-Policy disabling camera, microphone, geolocation, payment, USB, Bluetooth and HID. |
All eight are served on every page here, and on the 404. |
| Coverage, honestly | Not every Avieros hostname ships these yet. They are added as each surface is rebuilt and are verified against the real production response before that surface is called done — never against a developer machine, which is how a hardened localhost and a bare production went unnoticed here once already. | This site and apps.avieros.com serve the full set today. Several older pages serve none. |
2. Access control
- Fail closed. When an authorization check cannot complete, the request is denied. An error is never read as permission.
- Least privilege, with a worked example. The public marketplace needs to read published listings. Rather than give a public deployment a database key that bypasses row-level security, it reads a
security_barrierview exposing eight listing fields for rows that declare themselves public, using the publishable key only — and the base table's grant to anonymous callers is revoked. Proven in both directions: the public row is readable, the private one is not, and unrelated tables are refused. - Secrets are not in the codebase, and a machine checks. Every push is scanned across the full git history (
gitleaks), and a second check looks for credentials that would ship inside a browser bundle (scripts/proof/secret-scan.mjs). Either one failing stops the build. - Rotation on suspicion, not on confirmation. A credential suspected of exposure — in code, a log, a screenshot — is rotated first and investigated after.
3. Isolation between tenants
Many businesses, one platform. Isolation is enforced by the database, not by remembering to filter in application code.
| Control | Measured state | Enforced by |
|---|---|---|
| Row-level security coverage | 545 of 545 tables in the production public schema have RLS enabled — 100%. That is a count from the live database, not a policy statement. | scripts/proof/rls-enabled-coverage.mjs, run on every push. |
| Isolation is actually tested, and the test can fail | CI runs a cross-tenant check and then runs it again in a mode that deliberately makes it fail, so a check that has silently stopped checking cannot pass as a green tick. | scripts/proof/rls-isolation-ci.mjs, and --prove immediately after it. |
| One harness is currently switched off | rls-isolation-harness.mjs is commented out of the pipeline. The two checks above still run, so isolation is still gated — but this page will not describe a disabled harness as if it were running. |
Nothing, while it is commented out. That is the point of saying it. |
| A known exception, open today | One internal worker table is readable by any signed-in account. It is a real defect, it is tracked as WORKER-TABLE-RLS-ANY-AUTHENTICATED, it is being repaired, and it is named here rather than left for someone else to find. It does not expose business records or customer data; it exposes internal worker rows. |
Open. When it closes, this row goes. |
4. What happens when something goes wrong
A security page without an incident process is telling you how the locks work and nothing about what happens if someone gets in. Avieros runs a written plan with a severity ladder that decides the clock and the first move.
| Severity | What it means | First move |
|---|---|---|
| SEV-1 | Active cross-tenant or platform compromise, money rail, credential vault, or administrative override. One tenant reading another. Funds moved. | Contain before diagnosing: isolate the blast radius, revoke the implicated credential, cut the compromised integration, and roll production back to the last known-good deploy. |
| SEV-2 | A single tenant compromised, with no spread — one member account phished, contained by isolation. | Contain, notify the affected member, find the root cause. |
| SEV-3 | Exposure without confirmed compromise — a leaked non-critical key, a permissive policy caught before exploitation, a dependency advisory. | Rotate or patch on the stated clock. |
| SEV-4 | Hygiene and near-misses — a reported phishing attempt, a honeypot touched. | Log it and tune detection. |
Every incident runs the same loop: detect → contain → eradicate → recover → notify → learn. Notification is never self-cleared — it passes a counsel gate before anyone decides what to say, so the decision to tell you is not made by the person who would least like to.
The plan lists an AI kill switch among its SEV-1 containment moves. That switch is built, and its activation against live production is not yet verified — tracked as KILL-SWITCH-DOES-NOT-STOP-WORKERS. An unverified containment control is a containment control you do not have, and the plan says so itself rather than counting it. The other SEV-1 moves — credential revocation, cutting an integration, and instant rollback of a deployment — are exercised routinely and do work.
5. What we do not claim
- No third-party certification. Avieros holds no SOC 2, ISO 27001, HIPAA, or equivalent attestation. Nothing on this site is arranged to imply one.
- No bug bounty. There is no paid program. Good-faith reports are welcome and answered by a person.
- No penetration test to publish. No independent third-party assessment has been commissioned, so there is no report to summarise and none is implied.
- A small team. There is no security department behind these gates. That is exactly why the gates are automatic and why one of them proves it can still fail.
6. Report a vulnerability
If you believe you have found a security issue in any Avieros property, tell us. Include what you found and enough to reproduce it. Good-faith research that does not access, alter, or retain other people’s data will not be met with legal threats.
That opens a message to privacy@avieros.com with the subject line SECURITY. The full reporting page sets out what to include, the safe-harbour limits, and what happens after you send it — including the real response window rather than a service level nobody staffs.
Back This site runs no script, on purpose — so it genuinely cannot know where you came from, and will not pretend to. Your browser’s back button does know. The Trust Center overview is here if you would rather start again.