1Security of the product
The design principles are described in the technical overview. In brief:
- The attestation record is signed with the same key as the presentation and bound to the verifier's one-time request, so it cannot be detached, replayed or moved to another session.
- Where the platform supports it, a platform attestation covers the record's hash, so a modified record fails verification.
- A capability vector prevents downgrades: a signal the device cannot observe is reported as unknown, never as calm.
- There is no Calmproof server in the presentation flow, which removes a central point of attack and of data collection.
- Detection rates, false-positive rates and latency are measured in every pilot and reported in numbers.
2Security of this website
- Static pages only: no forms and no logins. Google Analytics is loaded only after you agree, and only from Google's measurement host. Advertising features stay off. One necessary cookie remembers the language.
- Fonts and scripts are served from our own domain.
- A strict Content Security Policy only allows resources from this domain.
- HTTPS only, with HSTS.
3Reporting a vulnerability
Write to security@calmproof.com. Please include:
- what is affected (website, demo app, SDK, specification) and the version, if known,
- the steps to reproduce, with a proof of concept where possible,
- the impact as you see it,
- how we can reach you, and whether you want to be credited.
Please do not include personal data of other people in your report.
4What we commit to
| Acknowledgement | Within 3 working days |
| First assessment | Within 10 working days, with our view of severity |
| Updates | At least every 14 days until the issue is resolved |
| Disclosure | Coordinated with you; by default 90 days after the report, or earlier once a fix is available |
| Credit | Named on this page if you wish, once the issue is fixed |
5Good-faith research
If you act in good faith and follow this policy, we will not take legal action against you for your research, and we will work with you to understand and fix the issue. Good faith means you:
- only test against systems and data you are allowed to use, and stop as soon as you reach someone else's data,
- do not degrade the service (no denial-of-service or load testing),
- do not use social engineering, phishing or physical attacks against people,
- give us reasonable time to fix the issue before telling anyone else.
We do not currently run a paid bug bounty programme.
6Scope
In scope: calmproof.com and its subdomains; the Calmproof demo app, SDKs and reference verifier once released; the published specification.
Out of scope: findings that require a rooted or already compromised device without further impact; missing best-practice headers without a demonstrated attack; reports generated only by automated scanners; third-party services we do not operate.