{
  "generated": "2026-09-13T22:25:37Z",
  "method": "measured from the live domain, the code and the dependency tree when this file was built",
  "transport": {
    "tls": {
      "measured": "2026-09-13T22:25:37Z",
      "versions": {
        "TLS 1.3": {
          "accepted": true,
          "cipher": "TLS_AES_128_GCM_SHA256"
        },
        "TLS 1.2": {
          "accepted": true,
          "cipher": "ECDHE-RSA-AES128-GCM-SHA256"
        },
        "TLS 1.1": {
          "accepted": false
        },
        "TLS 1.0": {
          "accepted": false
        }
      }
    },
    "certificate": {
      "measured": "2026-09-13T22:25:37Z",
      "issuer": "Let's Encrypt",
      "key": "rsaEncryption 2048-bit",
      "valid_until": "Dec  6 00:29:15 2026 GMT"
    },
    "caa": {
      "measured": "2026-09-13T22:25:37Z",
      "domain": "gagegreengroup.com",
      "authorised_issuers": [
        "letsencrypt.org",
        "pki.goog",
        "sectigo.com"
      ]
    },
    "hsts_preload_list": {
      "measured": "2026-09-13T22:25:37Z",
      "domain": "gagegreengroup.com",
      "status": "unknown"
    }
  },
  "headers": {
    "measured": "2026-09-13T22:25:37Z",
    "url": "https://law.gagegreengroup.com/",
    "headers": {
      "strict-transport-security": "max-age=31536000; includeSubDomains; preload",
      "content-security-policy": "default-src 'self'; script-src 'self' https://js.authorize.net https://jstest.authorize.net 'unsafe-inline'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com data:; connect-src 'self' https://*.supabase.co https://js.authorize.net https://jstest.authorize.net https://api.authorize.net https://api2.authorize.net https://apitest.authorize.net https://vjrfurqoyokxbcdwjdch.supabase.co; img-src 'self' data:; worker-src 'self'; frame-src 'none'; base-uri 'self'; form-action 'self'; upgrade-insecure-requests",
      "x-frame-options": "DENY",
      "x-content-type-options": "nosniff",
      "referrer-policy": "strict-origin-when-cross-origin",
      "permissions-policy": "camera=(), microphone=(), geolocation=(), payment=(self)",
      "x-dns-prefetch-control": "off"
    }
  },
  "supply_chain": {
    "commit_scanning": {
      "on_every_commit": [
        "gitleaks secret scan",
        "secret-shape scan",
        "direct model-provider call guard"
      ]
    },
    "dependency_audit": {
      "measured": "2026-09-13T22:25:37Z",
      "vulnerabilities": {
        "info": 0,
        "low": 0,
        "moderate": 0,
        "high": 0,
        "critical": 0,
        "total": 0
      },
      "dependencies": 284,
      "lockfile": true
    }
  },
  "disclosure": {
    "file": "/.well-known/security.txt",
    "in_release": true,
    "fields": {
      "Contact": "mailto:law@gagegreengroup.com",
      "Expires": "2027-03-13T00:00:00.000Z",
      "Preferred-Languages": "en",
      "Canonical": "https://law.gagegreengroup.com/.well-known/security.txt",
      "Policy": "https://law.gagegreengroup.com/security#disclosure"
    },
    "live": {
      "measured": "2026-09-13T22:25:37Z",
      "published": true
    }
  },
  "application": {
    "rate_limits": {
      "per_route_limit_per_address": true,
      "whole_api_ceiling_per_address": true,
      "sign_in_attempts_limited_per_address": true,
      "payment_requests_limited": true,
      "repeated_matter_access_alerts": true,
      "sources": [
        {
          "source": "Access-control and monitoring code",
          "sha256": "2ec1b4857f1d4c17a906da0018c272b81889890cd482d39120e2e75ad90c2681"
        },
        {
          "source": "Rate-limit code",
          "sha256": "faa61e4b298a712ad5fb22648230cb4ae62e20636647c139ff169fd4804621ba"
        }
      ]
    },
    "routes": {
      "patterns": 33,
      "require_identity": 27,
      "source": "Route access registry",
      "sha256": "2ec1b4857f1d4c17a906da0018c272b81889890cd482d39120e2e75ad90c2681"
    },
    "mfa": {
      "factor": "TOTP",
      "enforced_after_enrollment_window": true,
      "source": "Member sign-in code",
      "sha256": "c9309bb5138d6bb3c5f33d527bdd271ab09c110ce2c9d641e6ca60d028db6386"
    },
    "tests": {
      "security_cases": 160,
      "security_suites": 14,
      "all_test_files": 102,
      "suites": [
        {
          "suite": "api-security",
          "cases": 11
        },
        {
          "suite": "auth-recovery-smoke",
          "cases": 9
        },
        {
          "suite": "client-rendering-security",
          "cases": 3
        },
        {
          "suite": "docx-preview-security",
          "cases": 2
        },
        {
          "suite": "invite-sandbox-onboarding",
          "cases": 16
        },
        {
          "suite": "live-security-smoke",
          "cases": 9
        },
        {
          "suite": "local-dev-auth",
          "cases": 13
        },
        {
          "suite": "login-security",
          "cases": 24
        },
        {
          "suite": "rag-injection-fencing",
          "cases": 3
        },
        {
          "suite": "rls-sandbox-migrations",
          "cases": 11
        },
        {
          "suite": "sandbox-isolation",
          "cases": 17
        },
        {
          "suite": "security-critical-routes",
          "cases": 15
        },
        {
          "suite": "structured-data-security",
          "cases": 2
        },
        {
          "suite": "hardening",
          "cases": 25
        }
      ]
    }
  },
  "release_integrity": {
    "algorithm": "Ed25519",
    "fingerprint": "ed35:4e44:a0c5:540c:e3d7:5bb8:180c:2071",
    "published_kit": {
      "version": "9.27",
      "verifies": true,
      "measured": "2026-09-13T22:25:37Z"
    },
    "installer_refuses_unverified": true,
    "sources": [
      {
        "source": "Release signing tool",
        "sha256": "0ec69ba84916481fe93730d9547e369979b9806610667ac8e7385fe3bda0ae9e"
      },
      {
        "source": "Kit installer",
        "sha256": "146ae43b661ece7bd36d1d4577bd4a4986e1b14a44044bc065ca509ee0896b58"
      }
    ]
  },
  "data_handling": {
    "desk_bind": "127.0.0.1",
    "sensitive_questions_owned_hardware_only": true,
    "question_not_stored_on_gage_lane": true,
    "work_sessions_audited": true,
    "gateway_transport": "HTTPS on a private Tailscale (WireGuard) network",
    "sources": [
      {
        "source": "Desk server",
        "sha256": "0e277405f8effbbf491924aaaf0009ecd5b7c1f387966fe00ffd05bcafa503ea"
      },
      {
        "source": "Model lane routing",
        "sha256": "bf9ac7a2ee32c8a4c7b79f0e4ce9c9c61effbe06ba0fe20cf33b4d2c757e6087"
      },
      {
        "source": "Kit gateway configuration",
        "sha256": "f2cd46e405c046ce040c3406e363333439563293c7cde7a6a83bbb7bdbbcc70f"
      }
    ]
  },
  "subprocessors": [
    {
      "name": "Vercel",
      "purpose": "Website hosting and edge delivery",
      "evidence": "Live response header"
    },
    {
      "name": "Supabase",
      "purpose": "Member accounts, sign-in and member records",
      "evidence": "Content-Security-Policy"
    },
    {
      "name": "Authorize.Net",
      "purpose": "Card payments",
      "evidence": "Content-Security-Policy"
    },
    {
      "name": "Amazon Web Services (SES)",
      "purpose": "Transactional email",
      "evidence": "Email configuration"
    },
    {
      "name": "Resend",
      "purpose": "Transactional email, fallback",
      "evidence": "Email configuration"
    },
    {
      "name": "Tailscale",
      "purpose": "Private network between the installed kit and our gateway",
      "evidence": "Kit gateway configuration"
    }
  ]
}