MAGDOX Code Security documentation
Security model
How the CLI, rules and dashboard are protected, stated as design commitments.
Status: Preview
The largest security property is architectural: source code is never collected, so it cannot be exposed by MAGDOX. The commitments below cover everything else and are confirmed in writing per engagement. They are not third-party certifications.
| Area | Commitment |
|---|---|
| Source code | Never uploaded. Scans run on customer machines. |
| Secrets | Detected values never leave the machine under any setting. |
| Binary integrity | CLI releases signed (Apple notarisation, Authenticode, cosign) with published checksums. |
| Rule integrity | Rule and data bundles signed; the CLI refuses unsigned or tampered bundles. |
| Transport | TLS for all CLI and browser traffic. |
| Storage | Encryption at rest for findings, reports and exports. |
| Isolation | Organisation scope enforced on every request, including CLI downloads. |
| Identity | Short-lived user credentials in the OS keychain; scoped, expiring, revocable CI tokens; optional MFA and OIDC. |
| Audit | Sign-ins, token events, uploads, decisions and downloads logged and exportable by owners. |
| Vulnerability handling | Coordinated disclosure policy published on this site. |
Assurance status
No formal certification is claimed for this product. Assurance activities will be stated here when they exist.