Guide

Security

For platform admins: how robust Corpole's security is — each security suite's latest run, what is new or fixed, and the trend.

The suites

Authorization matrix: every MCP tool is called by every kind of principal. No tenant may read another's data, and no viewer, auditor or read-only connection may write.
Data-level guarantees: the database itself refuses rewritten history, links across tenants and unsealed private ideas.
Web and OAuth probes: headers, the session cookie, sign-in throttling and redirects, and the OAuth server end to end. Live headers repeats the header checks, read-only, on corpole.com.
Static and supply chain: known-vulnerable dependencies, secrets anywhere in the git history, and insecure code patterns.

Findings are graded critical, high, medium and low. A critical or high finding fails the run, and fails a pull request that touches access, data or the web surface.
New and fixed compare a run with the previous run of the same suite. Open a run to see its findings, the guarantees that held and its notes.
The suites run weekly and on every push to main; the runs from main are recorded here. They seed their own synthetic data and cost nothing.