Security

Last updated: August 2026

Security posture

WitnessOps is designed around:

• explicit trust boundaries
• signed receipts
• tamper-evident evidence bindings
• governed execution paths

These controls improve auditability and integrity, but do not eliminate external trust assumptions.

Vulnerability reporting

Report vulnerabilities to security@witnessops.com through responsible disclosure.

Do not send passwords, private keys, API keys, recovery codes, session tokens, or other secrets.

This mailbox is the canonical security contact. Aliases (e.g. security+witnessops@) may be used for controlled intake but do not replace it.

We aim to:

• acknowledge reports within 72 hours
• coordinate remediation prior to disclosure

Testing rules

Do not perform:

• destructive testing
• denial-of-service activity
• data exfiltration
• access outside authorized scope

If scope is unclear, stop and report.

Verification continuity

Previously issued proof artifacts remain verifiable independently of service availability, provided required public verification material is accessible.

WitnessOps web is an informational, inquiry, and verification interface. Rendering content, routing an inquiry, or providing bounded Ask WitnessOps guidance does not create verification authority or establish that a private system, action, or claim has been verified.

Verification authority resides in:

• signed receipts
• timestamps
• inclusion proofs
• external verification tooling