Built to be reviewed, not believed.

Posture

• Stdlib-only, zero network I/O. No third-party runtime dependency exists; the software bill of materials is CPython plus our package. The core never opens a socket — docker run --network none is the reference deployment and the full test suite passes under it.
• Every input is treated as hostile. BPMN, DMN, TWX, Control-M, JIL, crontab and CSV exports arrive from a different trust domain than the operator. All XML passes one hardened entry point that refuses DOCTYPE and entity declarations at the parser level and bounds reads at 50 MB; archives, CSVs and expressions carry their own budgets, including a 100 MB ceiling on run-history files.
• Identifiers are never paths. Node ids, decision references and run ids must match a strict character whitelist — no separators, no traversal. Every filesystem write under a run directory is containment-checked; history dates are validated twice before they ever name a directory.
• Evidence is redacted by default. Handler exceptions are masked for credential-shaped strings and PAN-like digit runs, truncated, and accompanied by a hash of the raw message; step results pass through a redaction hook before they are appended to the event log.
• Chain of custody. The hash of the handlers file is bound to the run at start; resuming with different code is refused unless explicitly overridden, and the override itself is evidenced.
• Proof bundles are append-only. A proof refuses to write over an existing bundle. Evidence does not get rewritten in place.

Falsifiability is under test

A proof that cannot fail is a false statement everyone trusts. Our test suite therefore contains mandatory mutation tests: seeded corruptions — a dropped dependency, a flipped status, a job that "ran" downstream of a failure — must flip the verdict to DIVERGED with the correct finding, and the untouched baseline must still pass. The diverging sample proof on this site is exactly such a seeded corruption, published on purpose.

Continuous integration runs the full suite plus three live proof gates on every change — including one that asserts the corrupt fixture must exit as diverged. Hostile job names (script and attribute injection) are part of the test corpus and render escaped in every report.

What we do not do

• No telemetry, no analytics, no phone-home — in the products or in their reports. The bridge from a report to us is printed text, not a beacon.
• No hosted service holding your data. There is nothing of yours on our side to breach.
• No silent capability. The Engine's agent slot ships unbound; nothing calls an agent nobody plugged in.

Reporting a vulnerability

Email support@handeware.com with the product, version (--version), a minimal reproduction, and the impact you believe it has. Please do not open a public issue for an unfixed vulnerability. We aim to acknowledge within two business days.