Security posture
Security
A bounded overview of security design without certification, immunity, or service-level guarantees.
Pre-publication draft: this document is not an approved public-beta contract. Publication and open registration remain disabled.
Document: security
Version: 2026-07-22-beta-readiness-1
Effective date: 2026-07-22
Content hash: 33aab07a87e56b33d7eb171ae574f55fbeae5b5048de7c7746d9d6b63f06fcfa
Security: security@gutmask.xyz
Current design
GutMask separates human control-plane, human runtime-plane, and Portal machine-channel authority. Authentication, session, ACL, audit, and release controls are designed as layered safeguards rather than absolute guarantees.
- Sensitive reports should use the private security contact.
- Do not place credentials, private keys, or unrelated personal data in a report.
Assurance boundaries
No certification, compliance status, penetration-test coverage, uptime, or incident-response time is claimed unless separately published with current evidence.
- See the Vulnerability Disclosure Policy for authorized testing boundaries.