Trust Center
Penetration testing
Last reviewed: 2026-05-25
Current status
No third-party penetration test has been completed yet. The first external test is scheduled for November 2026, six months after launch, and on an annual cadence thereafter. This page is updated to reflect the executive summary of each test as it completes.
In the meantime, the application surface is exercised by:
- Static application security testing (Semgrep) on every pull request.
- Dependency vulnerability scanning (Dependabot and Snyk) on every pull request and daily on
main. - A pgTAP test suite that asserts Row-Level Security on every tenant-scoped table. The suite is a required gate in CI; a regression blocks deploy.
- Pre-launch issuance of a private bug-bounty scope to a small group of trusted reviewers (planned, before public launch).
Planned cadence
| Cadence | Scope | Tester | Status |
|---|---|---|---|
| Annual | Authenticated application (Fly Sydney), API, Supabase RLS surface, authentication and session handling, file-upload pipeline, AI feature surfaces and prompt-injection resistance. | Independent Australian security firm (engagement scheduled). | First test: November 2026. |
| Pre-major-release | Targeted re-test of any new high-risk surface introduced since the last annual. | Same firm or specialist as appropriate. | As required. |
How findings are handled
- Critical findings: remediated before the report is final-issued, and re-tested by the firm.
- High findings: remediated within 30 days of report.
- Medium findings: remediated within 90 days of report, or accepted with a written justification recorded in the risk register.
- Low / informational findings: triaged, scheduled, and tracked to closure on the engineering backlog.
A summary appears in the table below after each engagement, including the date of the test, the firm, the scope tested, and the count of findings remediated by severity. The full report is shared under NDA with customers, prospects, and auditors on request.
Engagements
| Date | Firm | Scope | Critical | High | Medium | Low/Info | Remediated by |
|---|---|---|---|---|---|---|---|
| (scheduled — November 2026) | TBA | (per scope above) | — | — | — | — | — |
Change log
| Date | Change |
|---|---|
| 2026-05-25 | Initial publication. First external test scheduled November 2026. |