Runtime controls
Production runs a static container with a read-only filesystem, non-root user, no workload secrets, no service account token, and a default-deny egress NetworkPolicy.
Static site, strict runtime.
ComplyEaze Tools is deployed as a static container with no application backend, no accounts, no database, no analytics, and no document upload surface.
Supply chain
Releases are built from the public repository, pushed to GHCR, and deployed by immutable image digest. The publish workflow scans the image with Trivy before pushing the same tag and uploads SARIF evidence.
Report privately
Send security or privacy reports to security at complyeaze dot com with synthetic reproduction steps. Do not open public issues with taxpayer identifiers, credentials, portal screenshots, or document contents.
Testing boundary
Good-faith testing should avoid denial-of-service, credential capture, data exfiltration, persistence, social engineering, and access to data that does not belong to you.
Security posture
Security evidence
The public site is designed as a static browser-local surface. The table below ties the claim to repo-controlled tests, manifests, and workflow checks.
| Boundary | Evidence | Source | Cadence | Limit |
|---|---|---|---|---|
| Browser-local runtime | Source and built-output scanners block browser data-network APIs, background channel APIs, service-worker registration, and remote active resources. | tests/policy/runtime-network.test.ts and scripts/scan-built-runtime-network.mjs | pnpm verify | Protects tool input/runtime code; static hosting and edge security still process ordinary request metadata. |
| Content Security Policy | Nginx serves connect-src 'none', form-action 'none', frame-ancestors 'none', object-src 'none', and GET/HEAD-only static routes. | deploy/docker/nginx.conf | Container build and deploy smoke checks | Astro static islands currently require first-party unsafe-inline script/style allowance. |
| Static Kubernetes workload | Production manifests run a two-replica static nginx workload with no app secrets, no PVC, no service account token, read-only root filesystem, dropped capabilities, and non-root user. | deploy/k8s/base/deployment.yaml | pnpm scan:k8s and deployment review | Only static site hosting is in scope; Axal owns saved workflows, documents, and collaboration. |
| Network egress | A default-deny egress NetworkPolicy is applied to the tools workload. | deploy/k8s/base/network-policy.yaml | pnpm scan:k8s and production deploy | Does not describe Cloudflare or ingress metadata processing; see privacy notes. |
| Private security intake | Security and privacy reports route to private email with synthetic reproduction guidance. | SECURITY.md and apps/site/src/pages/security.astro | Governance review | Public issues must not include taxpayer identifiers, credentials, portal screenshots, or document contents. |
Release controls
Runtime boundary evidence
Required checks are listed here so users can distinguish source-backed controls from unsupported security claims.
| Check | What it covers | Source |
|---|---|---|
| verify | Runs pnpm audit:high and pnpm verify on pull requests and protected branches. | .github/workflows/ci.yml |
| Review gate | Blocks unresolved current-head review findings and requested-changes reviews. | .github/workflows/review-gate.yml |
| Analyze | Runs GitHub CodeQL with security-extended and security-and-quality queries. | .github/workflows/codeql.yml |
| Review dependency changes | Runs GitHub Dependency Review and fails on high-severity dependency changes. | .github/workflows/dependency-review.yml |
| Image scan and digest promotion | Builds the static image, scans it with Trivy, then publishes and deploys by immutable digest. | .github/workflows/publish-image.yml and .github/workflows/deploy-production.yml |
| Live deploy smoke | Deployment checks /-/health, CSP headers, and public sitemap content through a service port-forward. | .github/workflows/deploy-production.yml |