Security Policy

Truthful, controls-mapped, audit-ready posture for the WECO SPV-disclosure platform.

Effective: 2026-05-11 · Last revised: 2026-05-11 · Applies to release ≥ v1.0.0. Detailed traceability: see dist repo + docs/AUDITOR_TRACEABILITY.md in the release tarball.

1. Threat model

WECO publishes regulatory disclosures for SPVs / SFOs / fund vehicles. The threats we explicitly defend against, in priority order:

1. Public-site tamper — an attacker modifies a published disclosure (PDF replacement, content edit, defacement). Mitigations: append-only audit log, atomic deploy with rollback dir, per-slug advisory lock, signed releases, optional FS-WORM target for backups.
2. Admin-VM compromise — credential theft, account takeover, lateral movement. Mitigations: bcrypt cost 12, rate-limited login + account lockout, email 2FA (TOTP — Phase 2), per-host SSH-key encryption, append-only audit, optional KMS for `MASTER_SECRET`.
3. Supply-chain — backdoored dependency or release. Mitigations: minisign-signed release tarball, SHA-256 chain, public dist repo, SBOM published per release, npm package-lock pinned, install.sh self-checks SHA before running, FF_ALLOW_UNVERIFIED rejected on tagged releases.
4. License/JWT abuse — pirated or replayed license. Mitigations: Ed25519 signing key in offline laptop (production) / file-mode-600 on issuance server (trial), per-customer JWT with expiry, revocation list (Phase 2), tier-cap enforcement in DB layer.

Threats we explicitly do not defend against — see §6 "Out of scope".

2. Controls — what's actually shipped today

2.1 Authentication

2.2 Authorization

2.3 Encryption at rest

2.4 Encryption in transit

2.5 Audit and integrity

2.6 Supply chain

2.7 Install-time outbound network calls — full disclosure

The installer makes the following outbound HTTPS calls during initial install only (zero at runtime). Each is replaceable in the air-gap variant (Phase 2 Q3 2026) or via operator allowlisting:

No outbound calls at runtime. No telemetry, no auto-update, no analytics, no error reporting. Verifiable by inspecting the running VM with tcpdump -i any -nn after install completes.

3. Vulnerability disclosure

Send a description + reproduction steps + (if you have one) PoC to anton.orlov@nexaxt.com with subject [WECO-SECURITY]. Encrypt sensitive details with our PGP key (fingerprint published at /.well-known/pgp-key.asc from v0.0.18).

Our commitments to a reporter:

• Acknowledge within 2 business days.
• Confirm or deny the issue within 5 business days.
• Patched release for any critical/high CVSS finding within 14 calendar days.
• Public credit (or anonymity if requested) in the GitHub Security Advisory.

Bounty programme is in scope for Phase 2 (Q4 2026).

4. Audit trail of security claims

Every claim on this page maps to a file or table in the release tarball. To verify independently:

# Download
curl -LO https://github.com/antonorlov888/orox_siteconstuctor_admin-dist/releases/download/v0.0.18/ff-admin-v0.0.18.tar.gz
curl -LO https://github.com/antonorlov888/orox_siteconstuctor_admin-dist/releases/download/v0.0.18/ff-admin-v0.0.18.tar.gz.minisig
curl -LO https://github.com/antonorlov888/orox_siteconstuctor_admin-dist/releases/download/v0.0.18/ff-admin-v0.0.18.sbom.json

# Verify provenance
minisign -V -P 'RWQHQhnHIdSeftw6PLpDHYqFQRzDvTslvKw5mluIjFjyYfwumLT+9siX' \
         -m ff-admin-v0.0.18.tar.gz

# Verify SBOM (CycloneDX)
cat ff-admin-v0.0.18.sbom.json | jq '.components | length'

# Inspect security posture and CI
tar -xzf ff-admin-v0.0.18.tar.gz
cd ff-admin-v0.0.18
cat SECURITY.md          # this document, source of truth
cat LICENSE              # FSL 1.1 / Apache 2.0 future
cat EULA.md              # operational terms
ls .github/workflows/    # CI configs
cat admin/scripts/check-aad-binding.ts   # the AAD-binding lint that gates encrypt() calls

# Run the AAD-binding lint yourself
cd admin && npm ci && npm run check:security

5. Compliance posture

WECO is not independently certified at SOC 2, ISO 27001, or PCI-DSS as of 2026-04-25. We are realistic about this — a sole-developer, source-available product cannot ship pre-certified, and we do not claim what we do not have.

We are a viable building block for customers who hold their own SOC 2 / ISO 27001 / regulator certifications and need a compliance-publishing layer they can install inside their certified perimeter. The audit-export, append-only audit log, signed releases, and on-prem-only architecture are designed to map onto the customer's existing control framework.

For customers who require a vendor-side certification before procurement: SOC 2 Type II is on our 2027 roadmap, conditional on revenue. Until then, the alternative is the standard Vendor Security Questionnaire — we respond within 5 business days with citations into the source tree.

6. Out of scope (boundary statements)

The following are customer responsibilities, documented in §3 of the Customer Deployment Guide. We mark them out of scope here for honesty, not deflection — every WECO contract makes these explicit.

• Volumetric L3/L4 DDoS. Front the admin with a CDN/WAF (Cloudflare, Akamai, Imperva) or use the hosting provider's anti-DDoS service. WECO terminates at nginx; we do not absorb network-layer floods.
• Full-disk encryption (LUKS / dm-crypt / BitLocker). Set at VM creation. Every cloud provider supports this.
• Backup target separation. The pg_dump (containing encrypted host credentials) and the admin VM `.env` (containing MASTER_SECRET) must live on different backup media with different access controls. Together they re-create the single point of failure we encrypted against.
• Network-layer SIEM / IDS / EDR. WECO emits structured audit logs at the application layer; integrate them into your existing SIEM (Splunk, Elastic, Sentinel) via the audit-export endpoint.
• Personnel security clearance for operators with admin access. WECO provides RBAC primitives; identity vetting is the customer's process.

7. What this product does NOT do

For procurement-side honesty:

• WECO does not generate iXBRL / XBRL / ESEF / EMT-EPT / FIRDS / KID / PRIIPs filings. It is a CMS for the human-readable disclosure website that accompanies those filings; the structured filings are produced upstream (Workiva, Confluence, Donnelley Venue, fund administrator's tooling).
• WECO does not ingest live NAV / AUM / market data. The documents block accepts PDFs only. Customers that need live data display can render the data into an HTML block via the admin's API, but live feed connectors are out of scope.
• WECO does not provide HA / multi-AZ / hot-standby on Phase 1. Single Ubuntu admin VM. RTO/RPO targets are negotiated per Order Form for Premium / Enterprise tiers, with the customer's chosen backup cadence.
• WECO does not provide a migration path FROM other CMSes. New SPVs are configured fresh through the admin UI.

8. Contact

Security disclosures: anton.orlov@nexaxt.com · subject [WECO-SECURITY].

This document tracks tag-aligned changes in the dev repo at SECURITY.md. The web copy is updated within 7 calendar days of each release.