Write to us

How the den works

  1. No badges here.

    We hold no third-party security certifications. We don't sell anything, so there's nothing to certify. Read the work and judge it yourself.

  2. No SOC 2. No ISO 27001.

    Not Type I, not Type II, not in progress. No authority to assess, audit, or certify anyone against any framework.

  3. There's a human at the wheel.

    In a world of AI, that matters more than a badge.

Certifications held
None
No SOC 2, no ISO 27001, nothing in progress.
Human sign-off
Always
Agents propose. Nothing they write ships without a person.
Model inference
Anthropic
The one outside party in the agents' loop. No other model vendor.

The agent data boundary

  1. What the agents see.

    We run AI agents for the grunt work: diffing upstream releases, ranking findings, drafting write-ups. They work behind a hard boundary.

  2. Three things cross.

    Agents see inventory data, check results, and version strings. That's all they get.

  3. Five never do.

    Agents never see hostnames, IP ranges, configs, credentials, or log contents. The map from a tokenized host ID to a real hostname never enters a prompt.

  4. One outside party.

    Model inference runs through Anthropic, and only Anthropic. It's the one outside party in the loop.

A Human Holds the Key

AI proposes. A person decides anything that can't be undone.

That's not a slogan, it's how the work is wired.

  1. In Athanor, agents write and review the code. Every change waits for a person to approve the merge
  2. Anything irreversible waits for a person
  3. An agent can't grant approval to another agent. Only a person can
See the gate in Athanor

Our own kit

We eat our own cooking.

The machines we work from, held to the same standard we write about. Short list, because a short list of real things beats a long list of aspirations.

  • Dedicated work machines, with full-disk encryption and endpoint detection
  • Hardware-backed MFA on everything that matters, secrets in a password manager

Responsible disclosure

Found something? Say so.

Found a hole in something we published, or in this site? That's a real contribution to everyone running it. A hardening guide that ships a bug is the worst kind of bug, and we publish the correction with a date on it.

Security contactsecurity@opsfox.io

A human reads every report.

Disclosure guidelines
  1. Report to security@opsfox.io with a description and reproduction steps
  2. Allow a reasonable window to investigate and fix before public disclosure
  3. Don't access, modify, or delete data that isn't yours while researching
  4. No legal action against researchers acting in good faith. Ever
  5. There's no paid bounty. You get credited in the advisory unless you'd rather stay anonymous