Skip to content

Coordinated disclosure: an attestation pulse runs from the trust module of an edge container to a verifier. The loop, step by step: 1. Every device proves who it is. 2. The chain from source to console stands ready. 3. A device presents its identity. 4. Time and place are fixed to every sample. 5. The security module signs the claim. 6. The claim crosses the link. 7. Relays carry the packets without reading them. 8. The edge verifies every signature first. 9. The verifier checks it against policy. 10. Only a confirmed result leaves the edge. 11. The site is admitted, or refused. 12. The alert arrives with its evidence attached. 13. A disclosure reaches one route and is answered. 14. Sensors check that the response worked. 15. The whole chain is archived for audit. 16. Everything settles back to idle.

01 / 16

Every device proves who it is

Trust

Found a flaw? Tell us first.

Report vulnerabilities in observatory.global, its subsites and the open protocol tooling with the security form. We read every report, credit researchers who ask to be credited, and fix what is real.

01Disclosure

Report it. We take it from there.

  1. Send the detailsUse the security report form: what you found, where, how to reproduce it and its impact. You get a reference at once.
  2. AcknowledgementWithin 5 business days, with a reference.
  3. Triage and fixWe confirm severity, fix and tell you when it ships.
  4. Coordinated disclosurePublish after the fix, on a date we agree with you, and no later than 90 days after your report unless we agree otherwise.

In scope

observatory.global and its subsites, the forms and consent surfaces, and the open protocol tools we publish.

Rules of engagement

If you research in good faith and follow these rules, we will not take legal action against you for that research, and we will say so if anyone asks. Never access, change or keep other people’s data; stop and report as soon as you reach it. No denial-of-service, social engineering or physical testing of sites and instruments.

02Controls

Headers set on every page.

Set by the site core security-headers module. The content security policy starts report-only, then enforces once the reports are clean.

HeaderValueWhy
Content-Security-Policydefault-src ‘self’; script-src ‘self’ + hashes; connect-src ‘self’; report-only, then enforceOnly this site’s own code runs
Strict-Transport-Securitymax-age=31536000HTTPS only, for a year
X-Content-Type-OptionsnosniffFiles run only as their declared type
Referrer-Policystrict-origin-when-cross-originOther sites see the origin, not the page
Permissions-Policycamera=(), microphone=(), geolocation=(), payment=(), usb=(), browsing-topics=()Powerful browser features stay off
Cross-Origin-Opener-Policysame-origin-allow-popupsOther windows cannot reach this one
X-Frame-OptionsSAMEORIGINNo framing by other sites

No third-party script, font or tracker loads on this site: fonts, maps and 3D assets are served from observatory.global. Consent records, form entries and redirects stay in this site’s own database; form entries are stored encrypted.

Skip to content
Trust

Found a flaw? Tell us first.

Report vulnerabilities in observatory.global, its subsites and the open protocol tooling with the security form. We read every report, credit researchers who ask to be credited, and fix what is real.

01Disclosure

Report it. We take it from there.

  1. Send the detailsUse the security report form: what you found, where, how to reproduce it and its impact. You get a reference at once.
  2. AcknowledgementWithin 5 business days, with a reference.
  3. Triage and fixWe confirm severity, fix and tell you when it ships.
  4. Coordinated disclosurePublish after the fix, on a date we agree with you, and no later than 90 days after your report unless we agree otherwise.

In scope

observatory.global and its subsites, the forms and consent surfaces, and the open protocol tools we publish.

Rules of engagement

If you research in good faith and follow these rules, we will not take legal action against you for that research, and we will say so if anyone asks. Never access, change or keep other people’s data; stop and report as soon as you reach it. No denial-of-service, social engineering or physical testing of sites and instruments.

02Controls

Headers set on every page.

Set by the site core security-headers module. The content security policy starts report-only, then enforces once the reports are clean.

HeaderValueWhy
Content-Security-Policydefault-src ‘self’; script-src ‘self’ + hashes; connect-src ‘self’; report-only, then enforceOnly this site’s own code runs
Strict-Transport-Securitymax-age=31536000HTTPS only, for a year
X-Content-Type-OptionsnosniffFiles run only as their declared type
Referrer-Policystrict-origin-when-cross-originOther sites see the origin, not the page
Permissions-Policycamera=(), microphone=(), geolocation=(), payment=(), usb=(), browsing-topics=()Powerful browser features stay off
Cross-Origin-Opener-Policysame-origin-allow-popupsOther windows cannot reach this one
X-Frame-OptionsSAMEORIGINNo framing by other sites

No third-party script, font or tracker loads on this site: fonts, maps and 3D assets are served from observatory.global. Consent records, form entries and redirects stay in this site’s own database; form entries are stored encrypted.