Secure by Design progress
An engineering draft of our security progress and the evidence still needed. SafeGora does not claim to have signed the CISA pledge or completed its goals through this report.
Version 2026-09-22.1. Source reviewed 2026-09-22. This is a source inventory; it is not a deployment assessment or third-party certification.
The seven topics follow the CISA Secure by Design pledge. Source references identify the reviewed implementation and do not prove a control has operated successfully in a customer environment.
Multi-factor authentication
Goal not demonstrated
Primary authentication remains required; the reviewed policy does not require an additional MFA factor. No increase in MFA adoption is claimed.
Remaining evidence: An approved future authentication policy and measured adoption evidence are needed before claiming this goal.
Reviewed source references
packages/auth/src/employerPolicy.js:58–68
Default passwords
Partial source evidence
Pinned employer journeys use email-code authentication and disable password login. This is source evidence for that journey, not a product-wide default-password inventory.
Remaining evidence: Complete the account and integration inventory and observe each supported sign-in path.
Reviewed source references
packages/auth/src/employerPolicy.js:44–57
Vulnerability classes
Partial source evidence
The application has a token-based CSRF control and explicit route exemptions. Source existence does not demonstrate a measured reduction in vulnerability classes.
Remaining evidence: Bind current security test results and a reviewed vulnerability trend to the assessed product boundary.
Reviewed source references
services/api/src/middleware/csrf.js:143–150
Security patches
Partial source evidence
The repository delivery recipe orders migrations before application rollout. A delivery recipe alone does not prove patch adoption or that a particular build is serving.
Remaining evidence: Bind independent build, serving-image and release receipts, with the measured patch scope.
Reviewed source references
cloudbuild.yaml:811–830
Vulnerability disclosure
Partial source evidence
The existing security page describes coordinated disclosure and a good-faith research policy; security.txt identifies the reporting contact.
Remaining evidence: Confirm the policy owner and the delivered page and contact before treating the goal as established.
Reviewed source references
apps/web/src/app/security/page.tsx:73–95
Vulnerability reporting
Goal not demonstrated
The incident-response procedure is available. No CVE publication, completeness of CWE/CPE fields, or timeliness measurement is asserted by this report.
Remaining evidence: The security owner must provide any applicable vulnerability register, publication records and reporting measurements.
Reviewed source references
docs/security/incident-response-runbook.md:1–15
Intrusion evidence
Partial source evidence
The API exposes tenant-filtered audit listing and CSV export behind a role check. Source evidence does not prove retention, completeness, or availability to every customer.
Remaining evidence: Bind authenticated audit access, tenant isolation, completeness, retention and entitlement observations.
Reviewed source references
services/api/src/domains/compliance/routes/auditLog.js:1–24
Corrections and withdrawals
Report an inaccurate statement to Ollie@safegora.com. Corrections and withdrawn statements receive a new report version with a dated explanation. The earlier version remains in the source history. An unresolved or changed citation prevents this report from building; a source check never substitutes for approval or live evidence.
Version history
- 2026-09-22.1 — 2026-09-22: Publish the seven-goal source inventory with limitations; no goal marked achieved.