Security
The controls that protect privileged work, measured from the live service, the code and the dependency tree, with the source of every figure.
Evidence built September 13, 2026
At a glance
- TLS 1.3
- TLS 1.3 and 1.2 only; 1.1 and 1.0 refused
- measured September 13, 2026
- 0
- known vulnerabilities across 284 dependencies
- 0 critical · 0 high · September 13, 2026
- 160
- security test cases in 14 suites
- 27 of 33
- API route patterns that require an identity
- TOTP
- two-factor sign-in, enforced on member accounts after enrollment
- Limited
- sign-in attempts from any one address
- Ed25519
- signature on every release, verified before install
- ed35:4e44:a0c5:540c:e3d7:5bb8:180c:2071
- 127.0.0.1
- the only address the desk listens on
- the member’s own machine
Where data lives and where it is answered
The matter file stays on the member’s machine. A question about a matter is treated as sensitive, and a sensitive question is answered only on hardware we own, whatever lane is selected.
| Lane | Where a question is answered | Questions about a matter |
|---|---|---|
| Sovereign | Hardware we own; the question text is not stored | Answered here |
| Standard | Model providers, reached through our gateway | Routed to the sovereign lane |
| Your own key | The provider the member chooses, on the member’s own account | Routed to the sovereign lane |
- Local
- matters, evidence and drafts are kept on the computer the kit runs on
- 127.0.0.1
- the desk listens only on the member’s own machine
- Audited
- every work session writes its own audit log in the matter
- Not stored
- question text on our own lane
Network and transport
Measured against the live domain on September 13, 2026, with legacy protocols allowed on the testing side, so a refusal is the server’s.
| Protocol | Result | Negotiated cipher |
|---|---|---|
| TLS 1.3 | Accepted | TLS_AES_128_GCM_SHA256 |
| TLS 1.2 | Accepted | ECDHE-RSA-AES128-GCM-SHA256 |
| TLS 1.1 | Refused | — |
| TLS 1.0 | Refused | — |
| Control | Value |
|---|---|
| Certificate issuer | Let's Encrypt |
| Certificate key | RSA 2048-bit |
| Certificate valid until | Dec 6 00:29:15 2026 GMT |
| Authorised certificate authorities (CAA) | letsencrypt.org, pki.goog, sectigo.com |
| Connection from the kit to our gateway | HTTPS on a private Tailscale (WireGuard) network |
Response headers
As served by https://law.gagegreengroup.com/, read September 13, 2026.
| Header | Value |
|---|---|
| Strict-Transport-Security | max-age=31536000; includeSubDomains; preload |
| Content-Security-Policy |
|
| X-Frame-Options | DENY |
| X-Content-Type-Options | nosniff |
| Referrer-Policy | strict-origin-when-cross-origin |
| Permissions-Policy | camera=(), microphone=(), geolocation=(), payment=(self) |
| X-DNS-Prefetch-Control | off |
Access control
Every API route is classified in one registry, and the edge enforces the class before a request reaches the application. 27 of 33 route patterns require an identity. Limits apply per address; their values are not published.
| Control | Status |
|---|---|
| Requests to each API route, per address | Limited |
| Requests across the whole API, per address | Capped |
| Sign-in attempts, per address | Limited |
| Payment requests | Limited |
| Repeated reads of matter records | Raise a security alert |
Security tests
160 test cases in 14 suites guard the boundaries above, and run before every release.
| Suite | Cases |
|---|---|
| API access and rate limits | 11 |
| Account recovery | 9 |
| Safe rendering | 3 |
| Document preview | 2 |
| Invitations and member sandboxes | 16 |
| Live security checks | 9 |
| Environment separation | 13 |
| Sign-in security | 24 |
| Prompt-injection fencing | 3 |
| Row-level security | 11 |
| Matter isolation | 17 |
| Security-critical routes | 15 |
| Structured data safety | 2 |
| Platform hardening | 25 |
| All suites | 160 |
Supply chain and releases
Every commit is scanned before it lands, the dependency tree is audited, and every release of the kit is signed and verified before it installs.
| Control | Measured |
|---|---|
| Commit scanning | gitleaks secret scan, secret-shape scan, direct model-provider call guard |
| Dependency audit | 0 known vulnerabilities across 284 dependencies, September 13, 2026 |
| Lockfile | Committed, so installs are reproducible |
| Release signature | Ed25519, verified against a pinned public key |
| Key fingerprint | ed35:4e44:a0c5:540c:e3d7:5bb8:180c:2071 |
| Published kit | Version 9.27: signature verifies, September 13, 2026 |
| Unverified kit | The installer refuses it and writes nothing |
| Clean-room rehearsal | 10 of 10 install steps, 70 probes, version 9.27 |
Verify a kit yourself: python3 kit_signing.py --verify-file INSTALL.json
Subprocessors
Third parties that process data for the platform, each read from the configuration that uses it. The sovereign lane uses none.
| Subprocessor | Purpose | Evidence |
|---|---|---|
| Vercel | Website hosting and edge delivery | Live response header |
| Supabase | Member accounts, sign-in and member records | Content-Security-Policy |
| Authorize.Net | Card payments | Content-Security-Policy |
| Amazon Web Services (SES) | Transactional email | Email configuration |
| Resend | Transactional email, fallback | Email configuration |
| Tailscale | Private network between the installed kit and our gateway | Kit gateway configuration |
| Model providers | Standard-lane answers to questions not tied to a matter | Model lane routing |
Report a vulnerability
Write to us with the affected address, the steps to reproduce it and the impact you observed. Please do not access member data or degrade the service while testing.
| Field | Value |
|---|---|
| Contact | mailto:law@gagegreengroup.com |
| Expires | 2027-03-13T00:00:00.000Z |
| Preferred-Languages | en |
| Canonical | https://law.gagegreengroup.com/.well-known/security.txt |
| Policy | https://law.gagegreengroup.com/security#disclosure |
Sources
The part of the code each control was read from, with the SHA-256 of that file when this page was built.
| Controls | Read from | SHA-256 |
|---|---|---|
| Rate limits | Access-control and monitoring code | 2ec1b4857f1d… |
| Rate limits | Rate-limit code | faa61e4b298a… |
| Route registry | Route access registry | 2ec1b4857f1d… |
| Two-factor enforcement | Member sign-in code | c9309bb5138d… |
| Release integrity | Release signing tool | 0ec69ba84916… |
| Release integrity | Kit installer | 146ae43b661e… |
| Data handling | Desk server | 0e277405f8ef… |
| Data handling | Model lane routing | bf9ac7a2ee32… |
| Data handling | Kit gateway configuration | f2cd46e405c0… |