Skip to main content
Pentx Security · April 7-14, 2026 · 0 Critical · 0 High

Security
Posture Report

We publish our security posture openly — independent pentest results, CVE history, architecture controls, and SOC 2 progress. No marketing spin. Just the numbers.

0/0
Critical / High
100%
CI precision
182
Pentest cases
H2 2026
SOC 2 audit

Numbers an attacker has to defeat, not adjectives we picked for marketing.

0/0
Critical / High
Apr 2026 pentest
182
Pentest cases
9 attack categories
100%
CI precision
241-sample corpus
HMAC
Audit chain
deployment-keyed
TLS 1.3
Only
TLS 1.2 disabled
600K
PBKDF2 iters
OWASP 2024 spec
8
CI scanners
block every merge
7yr
WORM retention
S3 Object Lock
Independent Penetration Test · 2026-04-17

Independent Pentest — Zero Critical, Zero High

Black-box external test by Pentx Security across api.g8kepr.com, app.g8kepr.com, www.g8kepr.com, and g8kepr.com. 182 tests across 9 attack categories.

0
Critical

No exploitable, immediate-impact issues

0
High

No high-severity findings

3
Medium · Resolved

Remediated and re-verified in same window

2
Low · Accepted

Documented; compensating controls in place

7
Info · No action

Best-practice observations only

9 Attack Categories Tested · 182 Cases
AuthenticationAuthorizationInjectionSSRFIDORRate LimitingSession ManagementCryptographyMisc Configuration & Data Exposure

All 12 Findings — Disposition

Medium

Robots path disclosure — internal route hints in robots.txt

Disposition: robots.txt hardened to remove path leaks; non-public routes excluded from sitemap and crawler hints

Resolved
Medium

Marketing subdomain missing security headers (CSP, HSTS, Permissions-Policy)

Disposition: Full security-header set deployed across all marketing subdomains via shared middleware; verified at SSL Labs A+

Resolved
Medium

IPv4/IPv6 rate-limit normalization gap — limits applied per-address-family

Disposition: Rate limiter now normalizes IPv4-mapped IPv6 (::ffff:x.x.x.x) to canonical IPv4 before bucket lookup; unified per-client enforcement

Resolved
Low

Two low-severity findings — accepted risk, documented

Disposition: Reviewed and formally accepted as low-impact in the engagement report. Compensating controls documented; tracked for revisit at next pentest.

Accepted
Info

Seven informational findings — no remediation required

Disposition: Best-practice observations from the report (e.g., header tuning, response-fingerprint variance). No security impact; no action required.

No action

Full NDA-protected pentest report available to enterprise prospects on request. Request report →

Build-Gated Baseline · Generated 2026-04-19

Detection Quality, Verified On Every Commit

A 241-sample test corpus (191 attack samples + 50 benign) is checked into the repository at .github/threat-detection-baseline.json. Every commit runs the corpus through the detection engine. The build fails automatically if precision drops below 100% or recall drops below 87.96%.

Zero false positives on the full test corpus
99.71% threat-analysis success under load (2,424 concurrent requests)
Cache-hit detection overhead under 1 ms
Precision
1.000
0 / 50 false positives
Recall
0.880
168 / 191 caught
F1
0.936
composite score
Why It Matters

G8KEPR vs Typical SaaS Security

Most SaaS security is checkbox compliance — bolted on after the fact. G8KEPR built security into the core architecture from day one.

Topic
Typical SaaS
G8KEPR
Penetration testing
Annual checkbox — often skipped or internal-only
Full black-box + grey-box — 0 Critical, 0 High. All findings resolved before go-live
Audit logs
Mutable database rows — editable or deletable post-hoc
SHA-256 hash-chain — each record hashes the previous. Tampering breaks the chain
Tenant isolation
WHERE org_id = ? in app code — bypassable if there is a bug
PostgreSQL RLS policies — enforced at DB level, even if app code is wrong
Security headers
Basic HSTS + X-Frame-Options — CSP often missing or report-only
A+ SSL Labs — nonce CSP, Trusted Types, SRI, ModSecurity WAF, Brotli + HTTP/3
Dependency scanning
Periodic manual review or no process
pip-audit + npm audit on every PR as blocking CI gate — SBOM diff on every release
Secrets detection
Hope developers do not commit secrets
TruffleHog scans every commit. Runtime secret-leak detector in the backend pipeline
Field encryption
Full-disk encryption only — PII readable in the database
AES-256-GCM field-level encryption with per-tenant BYOK and zero-downtime DEK rotation
CVE response
Discovered during next sprint, patched weeks later
Next.js CVE-2025-29927 patched same day. P1 patch SLA is 72 hours
Defense in Depth

Four Independent Layers

A breach must defeat every layer independently. Each layer is operated and verified separately — there is no single point of failure.

Layer 1

Cloudflare WAF + Origin Gate

Edge

DDoS mitigation, origin IP hidden, TLS 1.3 terminated at edge

DDoS protectionTLS 1.3Origin masking
Layer 2

ModSecurity + OWASP CRS

Web

926 OWASP Core Rule Set rules active — blocks SQLi, XSS, RCE, path traversal

926 rulesSQLi/XSS blockOWASP Top 10
Layer 3

G8KEPR API Gateway

App

Rate limiting, JWT validation, scoped API keys, circuit breakers, MCP sandbox

JWT hardeningRate limitsMCP sandbox
Layer 4

RLS + Field Encryption

Data

PostgreSQL row-level security enforces tenant isolation at the DB layer

RLS tenant isolationAES-256-GCMBYOK / DEK
Architecturally Distinct from Cloud-WAF + Guardrail Stacks

Five Things No Competitor Has Shipped

Section 18 of the platform reference identifies these as novel technical contributions not available in competing products. They are the difference between a security platform and a security platform that actually holds up under audit.

OS-Level MCP Sandbox

RLIMIT_CPU/AS/NOFILE/NPROC, setsid() process-group isolation, Linux capability dropping, two-stage SIGTERM→SIGKILL. The MCP spec mandates none of this — we built it because tool calls execute with real system permissions.

934 LOCmodules/mcp/sandbox/executor.py

Tool Definition Hash Registry

Rug-pull detection. Tool definitions hashed at tools/list time, re-verified on every tools/call. A malicious MCP server cannot silently swap a safe tool for a malicious one mid-session.

SHA-256modules/mcp/tool_registry.py

Adaptive Z-Score Breaker

Statistical baselines per provider per hour-of-day, not static thresholds. 4 rolling windows. Progressive recovery 10/25/50/100%. More resilient than Hystrix or Resilience4j against degradation attacks.

3σ · 4 windowsgateway/router.py

Cross-Pillar Correlation

Every event across API → Gateway → MCP → Verification shares one correlation ID. Forensics from a single query — impossible to stitch together when each pillar is a separate vendor product.

one ID · 4 pillarsshared correlation_id

HMAC Hash-Chain Audit

Each entry signed via HMAC + deployment secret. Genesis derived from the key itself — unguessable. An attacker with full DB access still cannot forge a valid chain entry without the key.

7 modules · 3,866 LOCgenesis SHA-256 block
Every Header — Passing

Security Headers & TLS Configuration

Verified against SSL Labs, securityheaders.com, and Mozilla Observatory. TLS 1.3 only — TLS 1.1 and 1.2 are disabled. All headers are enforced server-side, not just report-only.

SSL LabsA+
Mozilla ObservatoryA+
securityheaders.comA
SSL/TLS Grade
A+
Content Security Policy
Strict
HSTS
max-age=31536000
X-Frame-Options
DENY
Permissions-Policy
Strict
Subresource Integrity
Enforced
Trusted Types
Enforced
ModSecurity WAF
OWASP CRS
Cryptographic Primitives

The Crypto Underneath

Concrete primitives, not vague "industry-standard" promises. Algorithm choices match OWASP 2024 guidance.

TLS 1.3 Only
AES-256-GCM · ChaCha20-Poly1305

TLS 1.2 explicitly disabled · mTLS for internal service-to-service

AES-256-GCM at Rest
96-bit nonce · 128-bit auth tag

Application-level encryption for API keys, OAuth secrets, TOTP, webhooks, MCP secrets

PBKDF2-HMAC-SHA256
600,000 iterations

Per OWASP 2024 password storage guidance · 256-bit output

bcrypt Passwords
Cost factor 12+

Timing-safe comparisons via hmac.compare_digest() everywhere

HMAC-SHA256 Audit Chain
Deployment-keyed

DB access alone cannot forge an entry · genesis block derived from the key itself

API Key Format
gk_org_sk_...

Prefix in transit · SHA-256 hash at rest · timing-safe lookup

JWT Secret Rotation
90-day cycle

Decryption keeps previous key as fallback · zero-downtime rotation

Encryption Key Rotation
1-year cycle

Envelope encryption · KEK in KMS or HashiCorp Vault · per-record DEK

CVE Response & Dependency Hygiene

pip-audit + npm audit run as blocking CI gates on every pull request

0
Critical CVEs ever

No critical dependency vulnerabilities found in project lifetime

1
Medium CVE (2025)

Next.js CVE-2025-29927 — header bypass. Patched same day, before any production traffic was routed

<24h
Avg. patch time

Automated alerts fire when a new CVE matches a pinned dependency version

8 Security Scanners Gate Every Merge

CodeQL

SAST · Python + TypeScript

Bandit

Python security linting

Trivy

Container CVE scanning

pip-audit

Python dependency CVEs

npm audit

Node dependency CVEs

OWASP ZAP

Dynamic AppSec testing

Gitleaks

Secret detection in git

Semgrep

Custom-rule SAST

Every PR runs all eight. Build fails on any new finding. TruffleHog scans every commit for accidentally committed credentials. SBOM diff is generated on every release.

7 of 9 Controls Complete

SOC 2 Type II Readiness

All technical controls are implemented and independently verifiable. We are not SOC 2 certified — we say so plainly. External auditor engagement is scheduled H2 2026. We disclose our actual status, not a vaporware claim.

Controls complete7 / 9
Technical controlsExternal audit H2 2026
Access Control (CC6)
Done
Encryption at Rest (CC6.7)
Done
Encryption in Transit (CC6.7)
Done
Audit Logging (CC7)
Done
Monitoring & Alerting (CC7.2)
Done
Incident Response (CC7.3)
Done
Change Management (CC8)
Done
Vendor Risk (CC9)
In Progress
Formal SOC 2 Type II Audit
H2 2026
Coordinated Disclosure Policy

Responsible Disclosure

Found a vulnerability? We want to hear from you. Report privately to security@g8kepr.com and we will acknowledge within 24 hours with an initial severity assessment and remediation timeline.

Security contactsecurity@g8kepr.com
Acknowledge SLA< 24 hours
P1 patch SLA< 72 hours
RewardHall of fame + recognition

Disclosure Steps

1

Report privately

Email security@g8kepr.com — description, reproduction steps, and impact. PGP-encrypted reports welcome.

2

We acknowledge within 24h

You receive confirmation and an initial severity assessment. We commit to a remediation timeline.

3

We patch and keep you updated

P1/P2 issues are patched before public disclosure. We will keep you in the loop on progress.

4

Coordinated public disclosure

We work with you on timing and credit for public disclosure after the fix is deployed and verified.

Incident Response SLAs

Defined runbooks for every severity level — DR drills run quarterly

P1 — Critical
Acknowledge15 min
Mitigate1 hour
Resolve4 hours
Data breach, full outage
P2 — High
Acknowledge30 min
Mitigate4 hours
Resolve24 hours
Auth failure, partial outage
P3 — Medium
Acknowledge2 hours
Mitigate24 hours
Resolve72 hours
Performance degradation
P4 — Low
AcknowledgeNext business day
Mitigate1 week
ResolveSprint
Non-critical bug
Open Security Posture

Security questions? Ask them directly.

We publish our posture because we have nothing to hide. Need the full pentest report, an architecture review session, or a call with our security team — reach out.