01
Secure development lifecycle
A Truenote-specific lifecycle defines security responsibilities from design and threat review through testing, release, and post-change verification.
Plain-language context
PCI DSS includes secure-software requirements for systems that are inside, or can affect, a cardholder data environment. For an application such as Truenote, that means disciplined software development, vulnerability detection, protection against common web attacks, and controlled releases. The safeguards below are the parts Truenote has completed and tested in this repository.
Completed safeguards
Each item below is backed by implementation, documentation, or a passed repository acceptance check.
02
Threat-driven testing
A documented threat model covers application, AI, provider, authorization, data, and PCI-impact boundaries. Negative tests exercise fail-closed behavior.
03
Pre-provider data screening
Deterministic high-risk input is checked before persistence and before calls to embedding, reranking, answer, and utility-model providers.
04
Model-output screening
Sensitive generated text is blocked before a normal answer is returned. Missing or invalid citations also produce a refusal.
05
Server-side access boundaries
Program and classification limits are applied before retrieval and checked again before protected content can reach generation or citation lookup.
06
Controlled content activation
Source, file, scan, parsing, lifecycle, and role checks must pass before knowledge content becomes available to users.
07
Automated security analysis
The delivery workflow runs CodeQL, secret scanning, dependency auditing, software bill of materials generation, type checks, builds, and unit tests.
08
Controlled change records
A tool-neutral change procedure and record format capture reason, impact, authorization, review, testing, deployment, recovery, and post-change verification.
09
Tamper-evident audit logic
Security events use append-only hash chaining. Durable SIEM delivery logic includes signed payloads, retry leases, backoff, and dead-letter handling.
Checks that passed
These results verify the repository implementation and its documented evidence package.
Access isolation
Negative tests denied cross-program and above-clearance retrieval, citation access, and document reads.
AI input boundary
Portable tests captured provider payloads and confirmed deterministic redaction before supported provider calls.
Citation and refusal rules
Tests rejected missing, malformed, unknown, and out-of-range citations and refused sensitive model output.
Browser request defense
Tests accepted trusted same-origin mutations and rejected foreign, opaque, malformed, cross-site, and sibling-origin requests.
Audit delivery logic
Tests passed signed delivery, lease fencing, retry scheduling, dead-letter handling, and delivery-health behavior.
Security delivery pipeline
Hosted checks passed type checking, production build, unit tests, secret scan, dependency audit and SBOM, and CodeQL analysis.
Open the complete public evidence set
Every completed safeguard and passed check named above is represented below. Each card opens the exact public repository document, implementation, test, or workflow record in a new tab.
Secure development and change management
Processes, design analysis, staff guidance, and release records.
- Secure development lifecycleSecurity responsibilities from design and threat review through release verification.Open evidence
- Application and PCI-impact threat modelTrust boundaries, abuse cases, mapped controls, and test references.Open evidence
- Secure-development curriculumTruenote-specific secure design, coding, tooling, and assessment material.Open evidence
- Change-control procedureAuthorization, review, testing, deployment, recovery, and closure workflow.Open evidence
- Production-change record formatComplete reason, impact, approval, test, deployment, and recovery record.Open evidence
- Master security evidence indexCross-reference for repository implementation, tests, workflows, and documents.Open evidence
AI and sensitive-data boundaries
Documented behavior, source implementation, and direct boundary tests.
- Provider input firewall recordSupported patterns, provider coverage, processing order, and acceptance checks.Open evidence
- Provider firewall implementationFail-closed redaction applied before supported provider payloads leave the server.Open source
- Portable provider-boundary testsCaptured OpenAI, Cohere, and OpenRouter payload assertions.Open tests
- Ask-input handling recordPre-persistence ordering and blocked deterministic high-risk input classes.Open evidence
- Ask-content policy implementationPure decision boundary for current questions and supplied history.Open source
- Ask-content policy testsBlocked classes, history coverage, and raw-free finding assertions.Open tests
- Model-output handling recordSensitive-output blocking, diagnostic redaction, and refusal behavior.Open evidence
- Cited-answer implementationCitation validation, sensitive-output screening, and fail-closed refusal path.Open source
- Generation safety testsCitation, fallback, route exhaustion, and sensitive-output cases.Open tests
Access, content, and browser controls
Server-side authorization, controlled activation, and browser-request defenses.
- Authorization-scoped retrievalProgram, classification, lifecycle, and active-version filters in retrieval.Open source
- Program-scope retrieval testsFail-closed rejection of leaked or cross-program retrieval candidates.Open tests
- Authorization negative-control testsCross-program, clearance, activation, and unsafe-state denial cases.Open tests
- Content screening implementationEICAR, secret, identity, payment-card, and prompt-injection detection.Open source
- Content screening testsSafe detection behavior without retaining matched sensitive values.Open tests
- Browser request-defense middlewareOrigin, Fetch Metadata, CSP, framing, MIME, referrer, and permissions controls.Open source
- Browser request-defense testsTrusted-origin acceptance and foreign, opaque, malformed, and cross-site denial.Open tests
Audit and secure delivery
Security-event integrity, durable delivery, hosted analysis, and evidence validation.
- Security-event audit implementationCorrelated security receipts and append-only event creation.Open source
- Durable SIEM delivery implementationSigned payloads, lease-fenced claims, retries, backoff, and dead-letter handling.Open source
- SIEM delivery testsSigning, lease, retry, completion, dead-letter, and health-reporting cases.Open tests
- SIEM delivery database controlsOutbox constraints, indexes, lease functions, grants, and verification queries.Open evidence
- Hosted security workflow resultsType checks, build, tests, secret scan, dependency audit, SBOM, and CodeQL.Open workflow
- Security workflow definitionExact hosted job configuration and retained security-analysis steps.Open source
- PCI evidence-integrity verifierMachine checks for links, hashes, workflow settings, threat rows, and evidence scopes.Open source
- Evidence-integrity verifier testsPositive and mutation cases for the security evidence gate.Open tests
- Public security-page testsRoutes, reporting links, public-only claims, and internal-ledger separation.Open tests