Security

Report a vulnerability, or see exactly how we handle security.

Two things live on this page: how to reach us about a security issue in any of our products or this site, and an honest account of how Leviathan Platform itself handles the data it collects when you deploy it — including what isn't done yet.

Same rule as the rest of this site: nothing here is marked done unless it's been checked against the real code, not assumed from a roadmap.

Report a vulnerability
[email protected]
GPG key ID
4FE39373E741C7AB
security.txt
/.well-known/security.txt

Reporting a vulnerability

Email us directly — please don't open a public issue.

Suspected vulnerabilities in this site or in any Northstar product go to the address below, not a public GitHub issue.

Security contact
Erlend Christoffer Hagen Hårsaker — [email protected], also reachable at [email protected] (same inbox).
GPG key
For encrypted contact, this is the same GPG key used to sign every release artifact:
4FE39373E741C7AB  ·  RSA-4096  ·  Erlend Christoffer Hagen Hårsaker
Verify the fingerprint against a keyserver before trusting it for anything sensitive — don't take a key ID on a website at face value alone.

There's no formal bug-bounty program or paid disclosure reward today. If that changes, this page will say so plainly rather than implying one exists.

Leviathan Platform — trust boundaries

What it does, and what it deliberately never does.

This section is about the product — what happens if you deploy Leviathan Platform on your own infrastructure. It's separate from this site's own data handling, which is covered in the privacy policy.

What it does

  • Deception, not enforcement. Honeytokens, decoy documents, and a bounded tarpit response — every detector recommends, nothing blocks or bans automatically. The operator's own infrastructure decides what to do with a recommendation.
  • Every action is scored before it runs. The Trust & Action Gateway classifies every non-trivial action to an explicit decision (allow / allow-with-confirmation / deny) before it executes — nothing acts on standing authorization alone.
  • Tamper-evident audit trail. Every run is recorded in a SHA-256 hash-chained, append-only Evidence Graph, with its own tamper-detection check.

What it deliberately never does

  • No hack-back. Nothing initiates contact with, runs code on, or degrades a system the operator doesn't control — regardless of whether the target is a confirmed attacker.
  • No beacons or persistence aimed outward. Decoy beacons point back to infrastructure the operator configures; there is no implant or C2 channel aimed at attacker infrastructure.
  • No DoS against attacker infrastructure. The tarpit is a bounded response to inbound traffic already hitting our own endpoint — it never reaches toward the attacker.
  • No targeting or deanonymizing real people. Detection stays scoped to source IPs/indicators touching infrastructure the operator owns — no real-identity resolution or OSINT-on-persons capability.
  • No fabricated certifications. The entropy self-tests are real sanity gates, not a NIST SP 800-90B/800-22 certified assessment, and the docs say so plainly.

Full detail, including the per-component guarantee/limit breakdown, is in the repository's own SECURITY.md — this page summarizes it, not replaces it.

Data handling & retention

What the platform collects, and how long it keeps it.

A honeypot collects data about whoever touches it. Under GDPR, an IP address is personal data — here's what's actually processed, and on what basis.

  • Source IPs and timestamps of canary trips — recorded server-side by the operator's own Defense.Api, never sent anywhere external.
  • Country/ASN labels — derived from an offline mapping the operator supplies; no external lookup service is called.
  • No payload bodies, no real-identity resolution, no cross-source profiling. Enrichment is limited to the offline geo/ASN label above.

Lawful basis

Legitimate interests — network and information security (GDPR Art. 6(1)(f); Recital 49 explicitly recognizes this basis for security processing). The operator deploying the platform is the data controller and owns the Legitimate Interests Assessment and DPIA decision for their own deployment — the platform doesn't make that call for you.

Retention

Retention is configurable and enforced, not just documented: attribution data has a scheduled sweep past a configured window, and the Evidence Graph has a run_retention.py job that purges whole old runs while keeping surviving hash chains intact. A hard guard (RETENTION_DAYS<=0) disables purging by default rather than silently wiping everything.

Compliance readiness

No SOC 2 or ISO 27001 certification yet. Here's what's actually in place toward it.

Those are real, larger undertakings — an accredited third-party auditor, typically 6–12 months of evidenced operation — and neither has started. What follows isn't a compliance claim; it's a controls inventory mapped to the five SOC 2 Trust Services Criteria, so a reviewer has something concrete to check against the actual open-source code instead of starting from zero.

Security

  • Every non-trivial action is scored before it runs. The Trust & Action Gateway (control/tool_manifest.py) classifies actions to allow / allow-with-confirmation / deny — nothing executes on standing authorization alone.
  • Egress firewall and memory quarantine. Iron-Thread blocks dangerous deserialization and gates file writes; the Memory Firewall (control/memory_firewall.py) quarantines instructions found inside content from external AI systems before they can poison persisted memory.
  • Rug-pull detection. MCP tool/skill pinning flags when a previously approved tool definition changes — a real, disclosed attack class, not a hypothetical.
  • Minimal attack surface by design. The self-hosted Agent Guardrails package ships with zero pip dependencies — nothing to compromise upstream.

Confidentiality

  • Secrets never persist into the audit log. redact_payloads=True on the Evidence Graph strips secret-shaped values before they're written, not after.
  • Self-hosted, not just "on-prem-optional." Nothing here calls out to a cloud API for its own operation — including the detector's multilingual and semantic classification steps, which run against a local Ollama model. Your data doesn't leave your infrastructure even to power our own tooling.

Processing integrity

  • Tamper-evident by construction. The Evidence Graph is a SHA-256 hash-chained, append-only log with its own verify_chain check — not an assertion that logs weren't altered, a way to prove it.
  • We red-team our own detector and publish the miss rate. The adversarial self-test harness mutates known-caught attacks and reports what still gets through — see the Agent Guardrails trust section for the current number, checked today, not a stale claim.
  • Real, currently-passing automated test suites — verified the same day this page states a number, not carried forward from an old release.

Availability

Self-hosted means your uptime depends on your own infrastructure, not ours — there's no vendor-side outage to inherit. That's a property of the deployment model, not a monitored SLA on our end: we don't operate your deployment, so we can't and don't promise its uptime.

Privacy

Covered in full above under Data handling & retention — legitimate-interests lawful basis, configurable and enforced retention, and the same zero-telemetry stance that applies to this website itself.

Regulatory readiness

We don't claim compliance. Here's what's now actually in force, and what the platform gives you toward it.

Three EU rules now directly affect anyone building or operating connected software or AI agents. None of them are something Leviathan Platform is certified against — no such certification exists yet for this category. What follows is what's legally live, and an honest mapping of what the platform gives you toward each one.

What's now in force

  • Cyber Resilience Act, Article 14 — live since 11 September 2026. Manufacturers of any "product with digital elements" placed on the EU market must notify ENISA and the coordinating CSIRT within 24 hours of becoming aware of an actively exploited vulnerability, follow up within 72 hours, and file a final report within 14 days (vulnerabilities) or one month (severe incidents).
  • AI Act, Article 50 — live since 2 August 2026. Transparency duties for AI systems that interact with people or generate synthetic content — chatbot disclosure and machine-readable content marking — with a grace period to 2 December 2026 for systems already on the market.
  • Revised Product Liability Directive (EU) 2024/2853 — classifies software and AI systems as "products" under strict, no-fault liability. Member States must transpose it into national law by 9 December 2026; it isn't in force as national law yet.

What the platform actually gives you toward this

  • Evidence for a CRA Article 14 report, not the report itself. The SHA-256 hash-chained Evidence Graph produces a tamper-evident, timestamped record of what an agent did — the kind of concrete artifact an Article 14 filing needs to describe how an incident unfolded. It doesn't talk to ENISA or a CSIRT, and it doesn't decide when your 24-hour clock starts — that's still your call.
  • A detection signal, not a compliance determination. The Trust & Action Gateway and the prompt-injection / schema-trust detectors can be the thing that tells you an actively exploited vulnerability exists in the first place. Whether a given event meets Article 14's notification threshold is a judgment call the platform doesn't make for you.
  • Honeytokens produce forensic evidence of an attempted compromise — a concrete "how we found out and what happened next" narrative, which is closer to what an incident report actually needs than a bare log line.
  • Self-hosted, zero external calls. Nothing about running the platform sends your data anywhere outside your own infrastructure — relevant to how you handle your own GDPR and Article 14 obligations, but that's a property of the deployment model, not a certification of anything.

What it doesn't do

It doesn't file anything with ENISA or a CSIRT on your behalf, doesn't generate Article 50 chatbot-disclosure copy or UI, doesn't perform a legal compliance determination, and isn't a substitute for your own counsel's read of the CRA, AI Act, or PLD as they apply to your specific product. This is security tooling that produces evidence you can use — not a compliance product, and it doesn't claim to be one.

Honest status

What's actually done, and what's still open.

No security page is worth much if it only lists what's finished. Here's both, checked against the real repository, not a roadmap.

✓Privacy contact and a concrete 5-step breach-notification process, documented in SECURITY.md
✓Bulk session-revocation tool — no more hand-typed DB deletes during an incident; scoped to one account or all, with a dry-run preview and a local audit log
✓Incident-report template, mapped directly to the breach-notification steps, so documentation happens during an incident, not reconstructed afterward
✓GPG-signed release artifacts, verified fingerprint published on this page
○SOC 2 Type II / ISO 27001 certification — not started. See Compliance readiness above for the concrete controls already in place toward it.
○Independent third-party penetration test — not done. An open, planned item, stated here before you'd have to ask.
○Legitimate Interests Assessment / DPIA documentation for a given deployment — the operator's responsibility per-deployment, not pre-filled by the platform
○No formal bug-bounty or paid-disclosure program yet