Security testing follows NIST SP 800-115: automated SAST, software-composition analysis, and secret-scanning on every build, plus a full functional and integration suite exercised against the running engine. Dynamic application security testing (DAST) has not been performed, and neither has an independent external review or penetration test — both are planned after Early Access.
+Security testing follows NIST SP 800-115: automated SAST, software-composition analysis, and secret-scanning on every build, plus a full functional and integration suite exercised against the running engine. Dynamic testing is limited to an automated authorization sweep — on every build, a live instance is probed over a real network socket to confirm that gated endpoints refuse unauthenticated and under-privileged callers. It does not cover the non-HTTP ingress listeners, the browser console, or TLS, and no independent DAST, external code review, or penetration test has been performed — all planned after Early Access.