TC-2026-0618-A
ASSESSMENT
June 18, 2026
AI-Assisted Internal Security Review (Claude Opus 4.8) — Trust Center Surface, 1 Low + 2 Informational
AI-assisted internal security review (Claude Opus 4.8) — not a third-party penetration test. Added alongside the preserved Claude Opus 4.7 records (2026-04-17/18 and 2026-05-18/19); the prior 4.7 records are intact and append-only. This round reviewed the trust.sigmashake.com worker — admin authn, the OTP/download/NDA token flow, rate limiting, reflected-XSS escaping, the email domain gate, secret handling, and CORS/headers — and found 3 findings: 1 Low, 2 Informational; 0 Critical, 0 High, 0 Medium. The Low (TRUST-2026-06-18-01) is a crypto-hygiene observation: the HMAC key derivation truncates a long TRUST_HMAC_KEY to 32 chars and zero-pads a short one (padEnd(32,"0").slice(0,32)); not exploitable alone (sign and verify share the derivation, 32 random chars is still ≥128 bits) but it discards entropy from a long provisioned secret — routed to the ISMS owner for a fixed-32-byte SHA-256(secret) derivation, not auto-patched. The two Informational items are honesty/stale-copy items (public report badge/metadata refreshed to this round; the corrected per-row-Ed25519 statement carried forward). Reviewed clean: constant-time admin Bearer compare (fail-closed), HMAC-SHA256 type/time-bound single-use tokens, increment-before-work rate limiting, universal output escaping, deny-by-default domain gate, vault-first never-logged secret handling, and CORS wildcards only on public read-only endpoints. The sigmashake-gov governance audit log is per-row Ed25519 signed (NOT Merkle-chained); hash chaining of daily roots (a linear SHA-256 chain, not a Merkle tree) is confined to the sigmashake-compliance evidence pipeline. SOC 2 status is self-assessed (observation window opened 2026-05-18 and closes 2026-11-17; no CPA firm engaged and no engagement committed; a Type II report is possible only after a CPA firm is engaged and completes its work, so not before Q1 2027). No external offensive-security firm and no CPA firm has been engaged; no third-party human-led penetration test is scheduled and no firm is engaged. Note 2026-10-13: the per-row Ed25519 signed statement for the governance audit log is withdrawn. The Go ssg binary signs no audit rows today (the signature column stays empty and ssg audit verify only reads). The audit log rows are not hash-chained. Note 2026-10-13: the Merkle statement for fleet R2 archival is withdrawn. The fleet R2 archive carries a SHA-256 digest over the comma-joined event ids, not a Merkle tree, and its R2 key is the SHA-256 of first id, last id and count, so it is deterministic and not content-addressed. The fleet per-org audit_events table is SHA-256 hash-chained. Compliance evidence manifests use a SHA-256 hash chain (a linear chain, not a Merkle tree; no inclusion proofs) with a daily Ed25519-signed root. The local ssg audit log is neither signed nor hash-chained and can drop entries. Note 2026-10-14: the 2026-06-18 round covered the trust Worker and the security Worker, plus the documentation copy. This bulletin names the trust Worker only. The security Worker finding is SEC-2026-0618-01 (1 Low: missing security response headers). The documentation copy items are DOCS-2026-0618-01 to DOCS-2026-0618-06. The phrase "the preserved Claude Opus 4.7 records (2026-04-17/18 and 2026-05-18/19)" above is shorthand for the preserved Claude Opus 4.7 record. That record covers three separate rounds: a 2026-04-17/18 deep review of 12 services and the CLI, a May 2026 sweep of the compliance Worker (published 2026-05-13; the exact test date is not evidenced), and the 2026-05-18/19 round across 27 production services. The fleet MDM agent-update review is a separate document dated 2026-05-20. The samples do not cover every service. No next round is committed. No third-party penetration test has been performed.
May 19, 2026
SigmaShake Response to npm High-Privilege Token Rotation (Mini Shai-Hulud Precaution)
On May 19, 2026, npm proactively rotated granular access tokens carrying write scope that bypass 2FA on token use, as a precaution against further supply chain attacks in the pattern of the "Mini Shai-Hulud" worm. Within seven minutes of receiving npm's rotation notice, we rotated the affected npm publish credentials held in our Cloudflare Worker secret store and confirmed our publishing automation is operating on the new tokens. We are evaluating npm Trusted Publishing as a follow-on hardening to further reduce reliance on long-lived publish tokens. No customer action is required.
TC-2026-0519-B
ASSESSMENT
May 19, 2026
SOC 2 Readiness Q2 AI-Assisted Internal Security Review — 17 Findings, Same-Day Remediation (Report v1.2.1)
Completed the Q2 surveillance round of the AI-assisted internal security review (Claude Opus 4.7) across a sample of 27 production services (the SOC 2 scope is 44 services as of 2026-10-14), scoped against OWASP WSTG v4.2, OWASP ASVS v4.0.3 Level 3, and PTES. The round identified 1 Critical (sigmashake-vibe project/preview IDOR — SSG-2026-043), 4 High (workspace inline-editor symlink escape, fleet pg-d1 schema-name interpolation, vibe deploy per-user rate limit, vibe magic-link atomic consume — SSG-2026-044..047), 4 Medium (vibe deploy error opacity, workspace edit body-size cap, affiliates Amazon ASIN allowlist, compliance staff-auth strict typeof guard — SSG-2026-048..051), and 8 Observation/Informational items. Every Critical, High, and Medium finding was code-level remediated and deployed the same day; the four Observation-tier items (download CDN integrity sidecar, ask prompt-injection framing, vcs RPC body schema, streamcord allowed_mentions escape — SSG-2026-052..055) were closed in a follow-on v1.2.1 close-out. Defense-in-depth additions landed alongside: workspace cloud-worker CORS pinned to a sigmashake.com origin allowlist with Vary: Origin; VS Code extension sanitizes sigmashake.workspace.daemonUrl (loopback or sigmashake.com over https only). The AI-Assisted Internal Security Review Report (v1.2.1) and the SOC 2 Type II Self-Assessment Package (v1.1.0) are downloadable under a draft NDA (click-through acceptance) from the document portal above; the static self-evaluation (bun run sigmashake-compliance/scripts/self-evaluate.ts) passes 27/28 with one non-blocking orphan-policy warning. Posture of the 2026-05-19 round (as of v1.2.1): zero Critical/High/Medium/Low items outstanding from that round; only Accepted-Risk design trade-offs and affirmative Observations remain. The later 2026-06-18 trust-surface round recorded one Low (TRUST-2026-06-18-01), status Open, ISMS-owner-routed. The Q3 2026 target for the next AI-assisted surveillance round has passed; no new round date is committed. No third-party human-led penetration test is scheduled and no firm is engaged. Note 2026-10-13: the current status word is self-assessed. No CPA firm is engaged and no SOC 2 report exists. "SOC 2 Readiness" in the title above is historical wording and does not describe an audit or a certification. Note 2026-10-14: the "2026-06-18 trust-surface round" named above covered the trust Worker and the security Worker, plus the documentation copy (security Worker: SEC-2026-0618-01, 1 Low). The "2026-05-19 round" in this bulletin is the 2026-05-18/19 round across 27 production services. The 2026-04-17/18 deep review and the May 2026 compliance Worker sweep (published 2026-05-13) are separate rounds. The fleet MDM agent-update review is dated 2026-05-20. No third-party penetration test has been performed.
May 13, 2026
GDPR & International Compliance — EU, UK, Switzerland Coverage Layer
Shipped the GDPR control family alongside SOC 2 + ISO 27001: 31 GDPR articles catalogued across Chapters II–V — 25 applicable, with documented applicability rationales for the 6 out-of-scope articles (Art. 8 / 9 / 10 / 22 / 26 / 37); 9 new evidence collectors covering DSRs, the Article 30 Record of Processing Activities, sub-processor freshness, breach-notification SLAs, privacy-notice currency, data-residency attestation, the consent-config collector (no consent records are written today), Transfer Impact Assessments, and the DPIA register; and 12 new policy and analysis documents (privacy policy, customer DPA template, DSR procedure, breach-notification procedure, international-transfer procedure, retention schedule, cookie policy, sub-processor management, DPIA procedure, EU representative analysis, DPO designation, and cryptography policy). Two new public endpoints went live alongside the existing verification API: POST /api/v1/dsr for data-subject-rights intake (rate-limited 5/hr/IP, opaque token in response, status lookup at GET /api/v1/dsr/:token); and GET /api/v1/sub-processors.json for the machine-readable Article 28(2) feed referenced in the customer DPA. UK GDPR + Swiss FADP are in the same self-assessment scope. Note 2026-10-11: no UK or Swiss transfer mechanism is recorded; a UK Addendum / IDTA and a Swiss addendum are targets, and the earlier statement that addenda are available on request is withdrawn. Catalog now covers 167 controls across 3 frameworks (43 SOC 2 + 93 ISO 27001 + 31 GDPR), 68 collectors, 28 policies. Self-evaluation: 27/28 pass with one non-blocking warning. Note 2026-10-11: these are the counts of 2026-05-13. The Controls Evidence Report now lists 84 entries, and 72 evidence collectors are registered.
May 13, 2026
AI-Assisted Internal Security Review — Compliance Worker (Claude Opus 4.7)
Targeted code-level AI-assisted security review of the sigmashake-compliance worker shipped 3 defense-in-depth hardenings: (1) open-redirect in the staff /compliance/login handler — old check accepted backslash sequences some browsers normalise to //host; now rejects backslashes, length-caps the next-URL, re-parses with the URL constructor, and verifies host equality before redirecting. (2) Input shape validation on POST /api/v1/verify — now enforces lowercase-hex regex for content_hash (SHA-256, 64 chars), signature (Ed25519, 128 chars), and a strict kid charset before reaching crypto.subtle. (3) Public sub-processor feed minimisation — stripped notes_md from GET /api/v1/sub-processors.json (could leak vendor SDK versions or internal DPA refs); at that time the public feed published id/name/url/category/data_access only. As of 2026-10-09 the feed also publishes purpose, data_categories and location. Reviewed clean: D1 query values bound (some SQL text uses allowlisted fragments), staff routes gated by CIDR-allowlist → auth → same-origin → CSP+nonce, Discord webhook host-allowlist, HMAC nonce+TS replay cache, Object Lock 90d on R2. Note 2026-10-13: the Object Lock on the evidence bucket is set by hand and its verification is an open action.
Apr 30, 2026
Compliance Automation Worker GA & Day-0 Gate Approaching
The sigmashake-compliance Worker is now live at compliance.sigmashake.com, executing 44+ automated evidence collectors at launch (Apr 30, 2026; 72 registered collectors as of 2026-10-09) on a daily / weekly / monthly / quarterly cadence. Every output is canonicalized, hashed, and Ed25519-signed; each day's content_hashes are chained with the previous daily root into a new SHA-256 root (a linear hash chain, not a Merkle tree; no inclusion proofs). The root is Ed25519-signed and cross-anchored into the public sigmashake-hub transparency log. A native Cloudflare D1 immutable backup pipeline writes hashed weekly snapshots to a dedicated R2 bucket protected by a 90-day non-bypassable Object Lock rule. Customers can verify any signed artefact against the public key at /.well-known/compliance-pubkey or via POST /api/v1/verify. The 6-month SOC 2 Type 2 observation window opened 2026-05-18 and closes 2026-11-17, with a SOC 2-aligned self-assessment publication targeted for 2026-12-31 (a self-assessment target, not an audit date; no CPA firm is engaged and no engagement is committed). Note 2026-10-13: the "non-bypassable Object Lock" wording in this dated bulletin is withdrawn. The Object Lock rule on the evidence bucket is set by hand in the Cloudflare dashboard, and its verification is an open ISMS-owner action. Only the D1 backups bucket has a lock rule set by script.
Apr 26, 2026
Self-Hosted Identity Provider Replaces Okta Tenant
SigmaShake's internal SSO has been cut over from a hosted Okta tenant to a self-hosted OIDC + SAML 2.0 IdP at sso.sigmashake.com. The new IdP supports OIDC authorization-code + PKCE, refresh-token rotation, RFC 7591 dynamic client registration, RFC 7662 introspection, RFC 7009 revocation, and back-channel logout. SAML 2.0 includes exclusive XML canonicalization, Single Logout, and quarterly signing-key rotation. MFA enrollment is via WebAuthn or TOTP with HIBP breach checks on password set; signing-key age is tracked by a weekly evidence collector. AI-agent self-enrollment uses the OAuth Device Code flow (RFC 8628) on the fleet side. The Okta token-endpoint fallback has been removed from the OIDC callback path.
Apr 22, 2026
SOC 2 Type II readiness self-evaluation complete — Day-0 Design Gap Closed
Every TSC control now has at least one wired-in evidence collector, every collector is bound to a cron batch, and every policy referenced by the controls catalog exists with auditor-credible content (no stub policies remain). The latest expansion added 9 collectors (training-completions, attestation-log, pen-test-report, quality-information-snapshot, internal-communication, control-matrix-snapshot, physical-access-inheritance, asset-disposal-attestation, r2-object-lock-verify), 4 new policies (code-of-conduct, external-communications, processing-integrity, system-description per AICPA TSP §300), and expanded 7 stub policies into full auditor-credible documents. A self-evaluation harness now runs at test, CLI, and runtime (bun run self-eval + GET /compliance/api/self-evaluation) and gates pre-commit. Note 2026-10-13: no pre-commit hook runs this harness; it is run by hand. 11/11 static checks pass; 62/62 tests pass. Note 2026-10-13: the current status word is self-assessed. No CPA firm is engaged and no SOC 2 report exists. The words "readiness" and "auditor-credible" in this dated bulletin are historical wording and do not describe an audit or a certification.
Apr 18, 2026
AI-Assisted Internal Security Review Published & Document Portal Overhaul
An AI-assisted internal security review report is now available to prospective enterprise customers under NDA. The review was performed by Claude Opus 4.7 (Anthropic) as a code-level security review aligned with OWASP WSTG v4.2, OWASP ASVS v4.0.3 Level 3, and PTES. This is not a third-party human penetration test; no firm has been engaged and no engagement is scheduled. The review identified 4 Critical and 12 High-severity findings across 12 services and the compiled CLI — every one remediated and verified closed the same day. We also replaced the broken "Request access" placeholders on this page with a real NDA + OTP flow, so every NDA-gated document — Controls Evidence, AI-Assisted Security Review, SOC 2 Readiness, and the full bundle — is downloadable after accepting the draft NDA (click-through acceptance). The Security Whitepaper is now a public download; no NDA required. Note 2026-10-13: the SOC 2 document named "SOC 2 Readiness" in this dated bulletin is now titled "SOC 2 Type II Self-Assessment Package"; the word "readiness" is historical wording and does not describe an audit or a certification. The CSA CAIQ Self-Assessment is a fifth NDA-gated report.
Apr 16, 2026
SIEM Log Forwarding GA & Trust Center Content Refresh
Fleet-side SIEM log forwarding is now generally available: dual-mode stream-and-archive pipeline with Splunk HEC, Cribl HTTP-in, Confluent Cloud Kafka REST, and generic HMAC-signed webhook sinks, plus an offline queue with replay-on-reconnect. Added as a shipped item on the Security Roadmap. We also completed a content-consistency pass across trust.sigmashake.com and security.sigmashake.com — unified responsible-disclosure SLAs (48h ack, 5-day triage, 30/90-day remediation) across every surface (superseded 2026-10-10 and 2026-10-11: the current targets are 72-hour acknowledgment with remediation targets of Critical 72 hours, High 7 days, Medium 30 days and Low next planned release, as stated in the Trust Center responsible disclosure section) and reconciled the published rule count for the TypeScript ruleset (11 rules).
Apr 14, 2026
Compliance Status Update
Updated compliance statuses to reflect our current standing as of April 2026. GDPR and CCPA are now marked as Self-Assessed, backed by implemented controls: opt-in telemetry, account deletion cascade, subprocessor transparency, DPA availability, and per-org D1 location hints. HIPAA and PCI DSS are marked Not Applicable — SigmaShake does not process PHI (we're a governance tool, not a health data processor) and all cardholder data is handled exclusively by Stripe (which states in its own published documentation that it is a PCI DSS Level 1 service provider). ISO/IEC 27001 work is internal-controls alignment only; no certification body has been engaged. Icons have been modernized with distinct, framework-specific designs and compliance status indicators. Note 2026-10-13: the statements about an account deletion cascade and per-org D1 location hints are withdrawn. Self-service deletion covers the accounts service only and other systems are handled by hand (DSR procedure section 4). Organizations share the fleet D1 by default, a small pool of dedicated databases can be assigned, no D1 location hint is configured, and no data-residency commitment is made. The status word for GDPR and CCPA is self-assessed. Note 2026-10-13: the statement that SigmaShake does not process PHI describes the default product behaviour. Payloads leave the machine only through opt-in paths (SIEM forwarding, opt-in telemetry, the opt-in BYOK Jev assist, remote evaluation); see the Local-First row. No statement is made that patient data cannot reach SigmaShake or TypeSafe.
Apr 12, 2026
Business Continuity & Procurement Transparency
We have added a new Business Continuity section to the Trust Center and Controls Evidence Report addressing the top procurement concerns for self-hosted vendors: local rule evaluation, source availability clause on vendor wind-down, key escrow plan, and SOC 2 Type II timeline. The landing page now includes an Honest Answers section responding directly to common technical objections. Note 2026-10-13: the offline-first and no-cloud-dependency wording in this dated bulletin is withdrawn. Rule evaluation makes no network call per tool call, but enforcement needs a paid license refreshed about every 6 hours. Air-gapped use is not supported and has not been verified.
Apr 12, 2026
Enterprise Security Controls — April 2026 Update
We have shipped and documented a significant set of enterprise security controls: Ed25519 bundle signing, per-row signed governance audit log (individually signed Ed25519 per event, when signing keys are configured) and fleet hash-chained event log, SAML/OIDC SSO with interactive provider selector, custom RBAC roles, org IP/CIDR allowlist, service accounts, per-org D1 location hints, tenant isolation guard (WS-21/22), P-256 license key rotation with JWKS endpoint, and a disk-backed fail-open audit queue. All 42 findings from four internal review rounds (fleet, CLI, MCP, QA) have been closed. The Controls Evidence Report has been updated to reflect these implementations. Note 2026-10-13: the per-org D1 location hint statement is withdrawn. Organizations share the fleet D1 by default, a small pool of dedicated databases can be assigned, no D1 location hint is configured, and no data-residency commitment is made. P-256 license signing deviates from the cryptography policy and is an open gap (see the controls report). Note 2026-10-13: the per-row signed governance audit log and the disk-backed fail-open audit queue named above are withdrawn. The Go ssg binary signs no audit rows today. Its audit queue is in process and bounded, and only the opt-in fail-open path buffers entries to a local file (see the controls report). Note 2026-10-13: the Ed25519 bundle signing named above is signing by the fleet service only. The Go ssg does not verify fleet bundle signatures on load.
Apr 6, 2026
SigmaShake Response to the Axios npm Supply Chain Compromise
SigmaShake Cloud is not impacted by the recently disclosed supply chain attack against the Axios npm package (axios@1.14.1 and axios@0.30.4), in which a compromised maintainer account was used to publish backdoored versions containing a cross-platform remote access trojan (RAT). No action is required by our customers.
Sep 2, 2025
SigmaShake Response to React (CVE-2025-55182) and Next.js (CVE-2025-66478) Vulnerabilities
We have actively patched all our internal services to address the disclosed vulnerabilities in React and Next.js. No customer data was exposed. Note 2026-10-13: the date and ID of this dated bulletin are unverified. Public advisories date both CVEs to December 2025, after the date shown, and the repository holds no record of the real response date.
Aug 18, 2025
SigmaShake Response to Shai-Hulud 2.0 Supply Chain Attacks
SBOM published and dependencies scanned against the Shai-Hulud 2.0 advisories. No affected package was found. This is a self-run scan, not a third-party audit. Note 2026-10-13: the date and ID of this dated bulletin are unverified. Public reports date Shai-Hulud 2.0 to late November 2025, after the date shown, and the repository holds no record of when the SBOM was published or the scan was run.
No bulletins match that filter.