Security Posture & Independent Verification
Pak-LLM Coder is architected with a security-first philosophy: client-side in-browser WASM isolation, non-bypassable human-in-the-loop approval gates, zero remote code retention, and cryptographic signing across all release artifacts.
WASM Sandbox Isolation
Code execution is compartmentalized inside WebAssembly memory enclaves. Browser globals (cookies, local storage, network sockets) are shadowed and inaccessible to evaluated guest scripts.
Detached PGP Signatures
All binaries, install scripts (install.sh, install.ps1), and SHA256SUMS are signed with detached PGP signatures verified fail-closed before execution.
Non-Bypassable HITL Gates
Autonomous agents cannot write to the filesystem, mutate directories, or install dependencies without explicit, interactive human authorization.
External Cybersecurity Audit & Pentest Report
All findings from our external cybersecurity audit have been systematically resolved under our zero-regression protocol. A sanitized public attestation report is published below for enterprise verification:
| Audit Domain | Identified Risk | Mitigation Deployed | Verification |
|---|---|---|---|
| Data Residency | Hybrid edge messaging clarity | Published Subprocessors & Data Flow directory | ✓ Verified |
| Model Provenance | Private weights verification gap | Published GGUF hashes, 32B MoE attestation & llms.txt card | ✓ Verified |
| Supply-Chain | Unsigned curl | bash risks | Detached PGP signatures + fail-closed SHA-256 verification | ✓ Verified |
| WASM Sandboxes | Potential DOM credential leakage | Strict scope shadowing: window, cookies & storage blocked | ✓ Verified |
| Multi-Tenancy | Guest workspace isolation | Ephemeral per-tenant enclaves + AES-256-GCM client encryption | ✓ Verified |
| Telemetry & Cookies | Long-lived tracking concerns | Zero tracking cookies; strictly ephemeral SameSite=Strict session | ✓ Verified |
Cryptographic Release Artifacts
Enterprise teams and security researchers can verify release integrity using our official public keys and checksum manifests:
Domain Anti-Spoofing & Email Authentication (SPF, DKIM, DMARC)
To prevent phishing, brand impersonation, and transactional email interception, all official communications originating from pak-llm.com, coder.pak-llm.com, and sbf-consultancy.net enforce cryptographically validated DNS email security controls:
| Protocol | DNS Host / Selector | Record Type | Published Value / Enforcement Policy |
|---|---|---|---|
| SPF (Sender Policy Framework) | @, coder | TXT | v=spf1 include:_spf.google.com include:_spf.larksuite.com ~all |
| DKIM (DomainKeys Identified Mail) | mail._domainkey, pakllm._domainkey | TXT | v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCg... (2048-bit RSA) |
| DMARC (Reporting & Conformance) | _dmarc, _dmarc.coder | TXT | v=DMARC1; p=quarantine; sp=quarantine; rua=mailto:[email protected],mailto:[email protected]; ruf=mailto:[email protected]; pct=100; adkim=r; aspf=r |
TLS 1.3 Certificate Automation & Edge Disclosures
Wildcard Let's Encrypt Auto-Renewal
Automated ACME HTTP-01 and DNS-01 challenges maintain active wildcard TLS 1.3 certificates across *.pak-llm.com, coder.pak-llm.com, and sovereign mirror infrastructure (mirror.coder.pak-llm.com). Renewal runs automatically every 60 days with multi-region synthetic uptime alerts.
Server Fingerprint Suppression
Platform headers (Server, X-Powered-By) are suppressed or minimized across all edge ingress nodes to eliminate infrastructure fingerprinting and prevent targeted framework reconnaissance (OWASP A05:2021).
Frame-Ancestors & Framing Controls
Strict clickjacking defense aligns with the parent domain (pak-llm.com) by enforcing X-Frame-Options: DENY and CSP frame-ancestors 'none' across all standard routes. Only internal sandbox previews (/preview) permit same-origin framing for the Web IDE. Top-level OAuth and Swich payment popups operate securely via Cross-Origin-Opener-Policy: same-origin-allow-popups.
WASM Execution & Strict CSP Nonces
Strict CSP Level 3 employs per-request cryptographic nonces and strict-dynamic with zero broad https:. All style directives (style-src, style-src-elem, and style-src-attr 'self') eliminate 'unsafe-inline' completely by enforcing cryptographic nonces and compiled CSS classes. The directive 'wasm-unsafe-eval' is required for the in-browser IDE / WASM runtimes (Pyodide Python engine, Tree-Sitter grammar parsers, V8 isolates, code execution sandboxes) as an intentional, documented, and accepted trade-off, while general JavaScript eval() is strictly prohibited.
Enterprise Mission Control Security Controls
The four-pillar Mission Control platform adds a governed multi-agent layer without weakening the existing WASM runtimes, terminal multiplexers, diff viewers or token metering. Controls are enforced in the browser orchestrator, server routes and worker fleet.
- AST-guarded patches: every proposed buffer is lexed for balanced delimiters, unterminated strings/templates/comments, invalid JSON, unsafe HTML and
javascript:URLs before it can mutate the virtual filesystem (NIST SI-7, OWASP LLM02). - Path traversal guard (CWE-22): absolute paths,
..segments, control characters,.git/.sshdirectories and credential files such as.envorid_rsaare rejected. - Command guard (CWE-78): destructive patterns, remote script pipes, reverse shells and system credential paths are blocked; shell metacharacters and privilege elevation force explicit human approval.
- Sandboxed previews (CWE-79): the browser verification surface runs in an
allow-scriptsiframe withoutallow-same-origin, forms or popups, with a restrictive CSP and no outbound network access. - Least privilege (NIST AC-3/AC-6): capability permissions and rate limits cover filesystem reads/writes, terminal execution, network fetches, worker spawns, artifact writes and Git worktrees. Writes, terminal execution and real worktrees require approval.
- Tamper-evident audit (NIST AU-6): a hash-chained ledger records mission creation, patch proposals, worker spawns, verification results, merges and artifact persistence; the admin audit endpoint verifies chain integrity.
- Worker isolation (ISO/IEC 42001): workers mutate only their own virtual branch snapshot. Merges are blocked until the milestone completes, verification passes and the user signs off. Real
git worktreeisolation is disabled by default and requires an admin secret plus a trusted root. - API hardening:
/api/mission-control/*responses setno-store,nosniff, deny framing, and adefault-src 'none'CSP. Verification payloads are size-limited, path-validated and rate-limited.
Vulnerability Disclosure & Security Hall of Fame
We welcome responsible disclosures from ethical hackers, security researchers, and enterprise teams. If you believe you have discovered a vulnerability, please contact our dedicated security team at [email protected] or [email protected].
Disclosure Guidelines:
- Do not compromise user accounts, access customer workspaces, or degrade sovereign production systems.
- Allow a reasonable grace period (typically 30–90 days) for our engineering enclave to patch issues before public disclosure.
- Confirmed and responsibly disclosed vulnerabilities qualify for recognition on our public Security Hall of Fame.
Security Hall of Fame:
The Security Hall of Fame honors independent security engineers who have helped keep the sovereign Pak-LLM platform safe.
External audit verification across NIST CSF 2.0, WASM sandbox isolation & detached signatures.