Webfold
Menu

Security

Security, stated plainly.

We publish our trust boundaries, including the findings that are still open, so you can judge the risk for yourself.

Report a vulnerability.

Do not open a public issue. Email security@webfold.ai with the affected version, the command, a minimal input and what you observed. Please give us time to triage before publishing details.

We treat as security issues: unintended code execution, file or network access, isolation failures, hostile-input denial of service, and misleading success that crosses a trust boundary.

What we publish.

Runtime boundaries and open findings →

What each path can reach, which helpers it calls, and what is still open.

Architecture →

The conversion, acquisition and execution paths and their limits.

Test and verification results →

Published runs, including what failed.

What we do not claim.

Know the limits

  • No third-party attestation such as SOC 2 or HIPAA yet.
  • Output is untrusted text. It is not sanitised HTML and not a defence against prompt injection.
  • Treat any interface that takes a URL as able to reach the networks available to the process, and run untrusted acquisition with restricted egress.

Trust centre →