Security posture
Security is a release gate.
Omnoryn designs automation systems around least privilege, explicit trust boundaries, observability, containment and recoverability. This page describes the current production security baseline and is not a certification claim.
Website baseline
- Static-first architecture to reduce attack surface.
- Restrictive Content Security Policy with no inline scripts.
- Frame embedding denied to reduce clickjacking risk.
- Browser capabilities disabled unless explicitly required.
- Staging and preview deployments are blocked from search indexing.
- No client credentials or automation secrets stored in front-end code.
Automation baseline
- Per-system credentials and least-privilege access.
- Secrets stored outside source control.
- Validation at trust boundaries.
- Idempotency and duplicate protection where side effects matter.
- Bounded retries, timeouts, structured logging and recovery paths.
- Human approval for destructive or high-impact actions when appropriate.
Vulnerability reporting
If you believe you found a security issue in an Omnoryn-controlled system, contact [email protected]. Do not include passwords, private keys or third-party secrets in the initial report.
Protected intake baseline
- Same-origin API route for Automation Audit submissions.
- Cloudflare Turnstile with mandatory server-side Siteverify validation.
- Strict request-size and field-length limits.
- Prepared database statements and no client-supplied SQL.
- No passwords, API keys or authentication secrets requested by the form.
- Rate limiting is applied at the Cloudflare edge to the public audit endpoint.
Ongoing production controls
Security remains an operational process. Changes to forms, APIs, third-party scripts or authentication flows require review of access controls, data retention, logging, monitoring and rollback behavior.