Security

Reporting a vulnerability

Email us directly — please don't open a public issue.

Suspected vulnerabilities in this site or in any Leviathan Platform product go to the address below, not a public GitHub issue.

Security contact: Erlend Christoffer Hagen Hårsaker — [email protected], also reachable at [email protected] (same inbox).

For encrypted contact, this is the same GPG key used to sign every release artifact:

4FE39373E741C7AB · RSA-4096 · Erlend Christoffer Hagen Hårsaker

Verify the fingerprint against a keyserver before trusting it for anything sensitive — don't take a key ID on a website at face value alone.

There's no formal bug-bounty program or paid disclosure reward today. If that changes, this page will say so plainly rather than implying one exists.

Leviathan Platform — trust boundaries

What it does, and what it deliberately never does.

This section is about the product — what happens if you deploy Leviathan Platform on your own infrastructure. It's separate from this site's own data handling, which is covered in the privacy policy.

What it does

Deception, not enforcement. Honeytokens, decoy documents, and a bounded tarpit response — every detector recommends, nothing blocks or bans automatically. The operator's own infrastructure decides what to do with a recommendation.
Every action is scored before it runs. The Trust & Action Gateway classifies every non-trivial action to an explicit decision (allow / allow-with-confirmation / deny) before it executes — nothing acts on standing authorization alone.
Tamper-evident audit trail. Every run is recorded in a SHA-256 hash-chained, append-only Evidence Graph, with its own tamper-detection check.

What it deliberately never does

No hack-back. Nothing initiates contact with, runs code on, or degrades a system the operator doesn't control — regardless of whether the target is a confirmed attacker.
No beacons or persistence aimed outward. Decoy beacons point back to infrastructure the operator configures; there is no implant or C2 channel aimed at attacker infrastructure.
No DoS against attacker infrastructure. The tarpit is a bounded response to inbound traffic already hitting our own endpoint — it never reaches toward the attacker.
No targeting or deanonymizing real people. Detection stays scoped to source IPs/indicators touching infrastructure the operator owns — no real-identity resolution or OSINT-on-persons capability.
No fabricated certifications. The entropy self-tests are real sanity gates, not a NIST SP 800-90B/800-22 certified assessment, and the docs say so plainly.

Full detail, including the per-component guarantee/limit breakdown, is in the repository's own SECURITY.md — this page summarizes it, not replaces it.

Data handling & retention

What the platform collects, and how long it keeps it.

A honeypot collects data about whoever touches it. Under GDPR, an IP address is personal data — here's what's actually processed, and on what basis.

Source IPs and timestamps of canary trips — recorded server-side by the operator's own Defense.Api, never sent anywhere external.
Country/ASN labels — derived from an offline mapping the operator supplies; no external lookup service is called.
No payload bodies, no real-identity resolution, no cross-source profiling. Enrichment is limited to the offline geo/ASN label above.

Lawful basis

Legitimate interests — network and information security (GDPR Art. 6(1)(f); Recital 49 explicitly recognizes this basis for security processing). The operator deploying the platform is the data controller and owns the Legitimate Interests Assessment and DPIA decision for their own deployment — the platform doesn't make that call for you.

Retention

Retention is configurable and enforced, not just documented: attribution data has a scheduled sweep past a configured window, and the Evidence Graph has a run_retention.py job that purges whole old runs while keeping surviving hash chains intact. A hard guard (RETENTION_DAYS<=0) disables purging by default rather than silently wiping everything.

Framework mapping

OWASP Top 10 for Agentic Applications — checked against the actual code, not asserted.

Enterprise buyers — especially in financial services, healthcare, and regulated SaaS — are already screening AI vendors against this list in procurement. Each row below is graded honestly: covered means a real, tested module exists for it; partial means real coverage that doesn't reach the full risk as OWASP defines it; open means no dedicated module exists yet, stated plainly rather than papered over with architecture talk.

✓	ASI01 Agent Goal Hijack — `prompt_injection_detector.py`'s INSTRUCTION_OVERRIDE and AGENTIC_HIJACK categories, dozens of pattern classes, tested against real adversarial mutations.
✓	ASI02 Tool Misuse and Exploitation — `mcp_argument_guard.py` scans call arguments for dangerous shapes; `mcp_lifecycle.py` enforces execution budgets and rejects tool-shadowing.
◐	ASI03 Identity and Privilege Abuse — the Trust & Action Gateway scopes every action by mission, tool, and environment with fail-closed defaults. Real permission-scoping, not a full identity/session system — it doesn't model "an agent borrowing a user's session" specifically.
✓	ASI04 Agentic Supply Chain Vulnerabilities — `mcp_tool_pinning.py` and `skill_pinning.py` hash-pin tool/skill definitions and flag drift; `subprocess_output_guard.py` scans command output before it's trusted.
✓	ASI05 Unexpected Code Execution — `stdio_harden.py` closes MCP's protocol-level STDIO RCE flaw; `mcp_argument_guard.py` catches dunder-chain/eval-shaped argument gadgets; Iron-Thread gates subprocess spawns.
✓	ASI06 Memory and Context Poisoning — `rag_guard.py`'s memory/RAG defense scans a record at both admission and recall, the two checkpoints that matter.
✓	ASI07 Insecure Inter-Agent Communication — `agent_message_guard.py`: replay detection, sender allowlisting, and payload injection scanning on every inter-agent message before its content can act.
○	ASI08 Cascading Failures — no dedicated cross-agent blast-radius detector yet. The platform's correlation story (one flagged signal read alongside another) is real but architectural, not a specific tested module against this risk. Open, stated plainly. Why it matters: a real, documented incident had one compromised "vendor-check" agent cascade false approvals through downstream procurement and payment agents, undetected until inventory counts fell dramatically — $3.2 million in fraudulent orders.
✓	ASI09 Human-Agent Trust Exploitation — this is what Probe Kit's social-engineering probe corpus is built for: flattery, fabricated urgency, fear-of-blame, peer-agent impersonation, and more, run continuously against real deployed agents.
○	ASI10 Rogue Agents — Stikkprøver continuously tests an agent's response to injected adversarial scenarios, but that's different from detecting spontaneous, self-directed misalignment an agent wasn't provoked into. Open, stated plainly.

Real count: 7 of 10 covered, 1 partial, 2 open. MITRE ATLAS (the adversarial-AI knowledge base behind ATT&CK) maps onto the same modules from a different angle — its "Escape to Host" and "Publish Poisoned AI Agent Tool" techniques land directly on Iron-Thread and MCP Gateway's admission scanning, respectively.

Compliance readiness

No SOC 2 or ISO 27001 certification yet. Here's what's actually in place toward it.

Those are real, larger undertakings — an accredited third-party auditor, typically 6–12 months of evidenced operation — and neither has started. What follows isn't a compliance claim; it's a controls inventory mapped to the five SOC 2 Trust Services Criteria, so a reviewer has something concrete to check against the actual open-source code instead of starting from zero.

Every non-trivial action is scored before it runs. The Trust & Action Gateway (control/tool_manifest.py) classifies actions to allow / allow-with-confirmation / deny — nothing executes on standing authorization alone.
Egress firewall and memory quarantine. Iron-Thread blocks dangerous deserialization and gates file writes; the Memory Firewall quarantines instructions found inside content from external AI systems before they can poison persisted memory.
Rug-pull detection. MCP tool/skill pinning flags when a previously approved tool definition changes — a real, disclosed attack class, not a hypothetical.
Minimal attack surface by design. The self-hosted Agent Guardrails package ships with zero pip dependencies — nothing to compromise upstream.

Confidentiality

Secrets never persist into the audit log. redact_payloads=True on the Evidence Graph strips secret-shaped values before they're written, not after.
Self-hosted, not just "on-prem-optional." Nothing here calls out to a cloud API for its own operation — including the detector's multilingual and semantic classification steps, which run against a local Ollama model. Your data doesn't leave your infrastructure even to power our own tooling.

Processing integrity

Tamper-evident by construction. The Evidence Graph is a SHA-256 hash-chained, append-only log with its own verify_chain check — not an assertion that logs weren't altered, a way to prove it.
We red-team our own detector and publish the miss rate. The adversarial self-test harness mutates known-caught attacks and reports what still gets through — currently 12 of 160 mutated variants (7.5%), checked before every fix that ships.
Real, currently-passing automated test suites — 1,225 Python tests and 151 .NET tests, verified the same day this page states a number, not carried forward from an old release.

Availability

Self-hosted means your uptime depends on your own infrastructure, not ours — there's no vendor-side outage to inherit. That's a property of the deployment model, not a monitored SLA on our end: we don't operate your deployment, so we can't and don't promise its uptime.

Privacy

Covered in full above under Data handling & retention — legitimate-interests lawful basis, configurable and enforced retention, and the same zero-telemetry stance that applies to this website itself.

Honest status

What's actually done, and what's still open.

No security page is worth much if it only lists what's finished. Here's both, checked against the real repository, not a roadmap.

✓	Privacy contact and a concrete 5-step breach-notification process, documented in `SECURITY.md`
✓	Bulk session-revocation tool — no more hand-typed DB deletes during an incident; scoped to one account or all, with a dry-run preview and a local audit log
✓	Incident-report template, mapped directly to the breach-notification steps, so documentation happens during an incident, not reconstructed afterward
✓	GPG-signed release artifacts, verified fingerprint published on this page
○	SOC 2 Type II / ISO 27001 certification — not started. See Compliance readiness above for the concrete controls already in place toward it.
○	Independent third-party penetration test — not done. An open, planned item, stated here before you'd have to ask.
○	Legitimate Interests Assessment / DPIA documentation for a given deployment — the operator's responsibility per-deployment, not pre-filled by the platform
○	No formal bug-bounty or paid-disclosure program yet

Report a vulnerability, or see exactly how we handle security.