TRUST CENTER / CLARITY BY DESIGN
Know your controls.
Understand your boundaries.
The security model is written down. This has proved more useful than printing a padlock next to the word “military.” Here’s what works, where the boundaries are, and what still needs validation.
Controls you can inspect.
| Area | Implemented in v0.3 |
|---|---|
| Administrator access | Argon2id password hashing, hashed sessions, HttpOnly/SameSite cookies, CSRF protection, Host/Origin checks, and login throttling. |
| Policy integrity | Versioned Ed25519 endpoint signatures, rollback protection, policy expiry, and firewall drift repair. |
| Paired control | Hybrid X25519 + ML-KEM-768 TLS, pinned master identity, authenticated requests/responses, durable nonce rejection, and encrypted local credential pools. |
| Local data | SQLite configuration and history, bounded retention, optional query logging, and operator-managed storage. |
| Distribution tooling | Artifact verification, CRX3 checks, and native publisher signing workflows. Production identities still need to be supplied and validated. |
Fine print. Normal-sized type.
- One locally initialized administrator. Product RBAC, SSO, and MFA are not implemented. Website sign-in through Cyberplexs does not add SSO to the filtering product.
- Endpoint policy is a strict destination allowlist. Approved destinations can still carry tunnels. Local administrators/root can remove controls.
- Browser inspection has limits. Normal interactive pages are inspected after loading. This is not pre-execution malware isolation.
- Reported OS identity is not hardware attestation. A UID or SID is account context, not proof of an uncompromised device.
- Hybrid TLS has a boundary. Certificates and offline Ed25519 signatures remain classical. Privileged local access can steal credentials.
- Operators own deployment security. Storage permissions, backups, disk protection, network configuration, and acceptance testing are part of running the service.
No SOC 2, ISO certification, independent audit, or commercial SLA is claimed for this release. A planned service is not a certified control.
v0.3 / RELEASE EVIDENCE
“Works” needs a little context.
The upstream project documents the following validation. These are development results, not a guarantee for every fleet.
| Component | Evidence described upstream | Still required |
|---|---|---|
| Core service | Local tests for DNS, authentication, APIs, identity, signatures, and policy state. | Independent security review and performance benchmarks. |
| Portal & extension | JavaScript and Chromium integration coverage for enrollment, navigation, categories, reader behavior, and revocation. | Broader browser/version and managed-fleet acceptance. |
| Linux endpoint | Isolated-kernel enforcement, drift repair, expiry, quarantine, hybrid pairing, signed removal, and rollback tests. | Deployment-specific service/reboot and fleet acceptance. |
| Windows & macOS | Earlier firewall-adapter cross-platform checks; native CI configured for the newer control channel. | Native firewall activation, connection behavior, reboot, rollback, and removal acceptance. |
| Distribution | Disposable-key signing and corruption rejection. | Production certificates, notarization, store/feed publication, and managed updates. |
Found something that needs fixing?
Follow the project’s security reporting instructions. Don’t include credentials, live logs, or vulnerability details in a public sales-interest request.
Read the security policy ↗