Security and vulnerability disclosure

Report vulnerabilities to the contact in security.txt. Include the affected URL, the steps to reproduce and the impact you observed.
Test only against your own workspace and synthetic data. Never access, modify or delete data that is not yours, and stop as soon as you reach someone else's data.
We acknowledge reports within two business days and keep you informed until the issue is fixed.
We will not pursue good-faith research that follows these rules.

security.txt

# AGORA security contact (RFC 9116). Demo build: synthetic data, fictional businesses.
# Report vulnerabilities to the role address below; please do not test against other customers' data.
Contact: mailto:security@app.fondaq.ai
Expires: 2027-04-25T00:00:00.000Z
Canonical: https://app.fondaq.ai/.well-known/security.txt
Policy: https://app.fondaq.ai/trust-centre/security
Acknowledgments: https://app.fondaq.ai/trust-centre/security#acknowledgments
Preferred-Languages: en

Served at /.well-known/security.txt (RFC 9116).

Acknowledgments

No reports have been acknowledged on this demo host yet.

Security and compliance controls (spec 18), as built in the demo

This page maps each area of spec Section 18 to the control the demo implements, and to the evidence for it: a test, a script, or a console page. Where the product control needs infrastructure the demo does not run (ADR-011), the gap is stated rather than simulated. The demo holds synthetic data about fictional businesses only.

Area (spec 18)	Product requirement	Demo control	Evidence
Payment data (R1, R2)	No PAN or CVV anywhere; PSP tokens and handler payloads only; schemas reject PAN patterns; log scrubbing; checkout-path penetration test	Adapters scan every agent-facing payload (`server/src/modules/commerce/pan.ts`). The event bus refuses PAN-shaped values (`server/src/modules/platform/events/bus.ts`). The pinned schemas reject 13–19 digit runs and card-field names (`protocols///*.schema.json`). Completion requires the merchant PSP's `psp_ref`, and no code path marks an order paid without it.	`server/test/commerce.test.ts`, `server/test/platform-r1.test.ts`, the `pan-fuzz-` goldens in `conformance/golden/`, `scripts/scan-pan.mjs` in CI. The penetration test is not in the demo*.
Data protection (GDPR, UAE PDPL)	Tenant home region; DPA templates; purpose limitation and consent flags; PII redaction in lab captures; data subject request tooling; retention	Region pinning with explicit residency exceptions (`server/src/modules/platform/residency.ts`). A data subject export or delete runs across modules as audited steps (`server/src/modules/platform/dsr.ts`). Leads carry consent records, and synthetic populations carry consent flags.	`server/test/platform-core.test.ts`, `server/test/platform-integration.test.ts`, runbook `docs/runbooks/09-data-subject-deletion.md`. DPA templates and retention lifecycle rules are not in the demo.
Evidence integrity (R4)	Append-only store, hash chain per merchant, nightly verification, signed exports, optional TSA	The evidence store has no update or delete path. `chain_hash = SHA-256(prev_hash, payload_hash, kind, verified_at)`. A verifier runs on an interval and on demand. Exports are signed with a detached Ed25519 signature (`server/src/modules/trust/evidence.ts`). DDL: `docs/architecture/ddl/trust-evidence.sql`.	`server/test/trust.test.ts` (tamper detection, export, verify), console Trust page Verify chain, runbook `docs/runbooks/07-evidence-chain-verification-failure.md`. TSA is not in the demo.
Agent-facing security	Signature verification and replay protection; sanitised projections; prompt-injection filter; strict JSON Schemas on tool inputs and outputs; per-agent rate limits; session anomaly detection	Web Bot Auth (RFC 9421) verification with nonce replay rejection (`server/src/protocols/webbotauth.ts`). The trust-edge applies registry tiers, Cedar-subset policy and rate classes (`server/src/protocols/trustEdge.ts`, `server/src/modules/trust/`). An injection-hygiene filter runs on every machine field (`server/src/protocols/hygiene.ts`). MCP inputs are validated against each tool's `inputSchema`. Risk scoring lives in `server/src/modules/trust/risk.ts`.	`server/test/protocols.test.ts`, `server/test/protocols-wave2.test.ts` (injection hygiene, network programmes), `server/test/protocols-edge.test.ts`, `server/test/trust.test.ts`, `conformance/golden/ucp/2026-01-11/trust-edge-required`.
Platform security	SSO/SAML, MFA, RBAC, audit log; Vault/KMS; TLS and mTLS; dependency scanning, SAST, container scanning, SBOM, signed images; least privilege; access reviews	The single demo account uses a signed session cookie, with timing-safe password checks and a login rate limit (`server/src/auth/`). Secrets come from environment variables only. `scripts/scan-secrets.mjs` runs in CI. The image is non-root with a read-only filesystem (`Dockerfile`). New dependencies need an ADR (`CLAUDE.md`).	`server/test/api.test.ts`, `.github/workflows/ci.yml`. SSO, MFA, Vault/KMS, mTLS, SAST, SBOM and cosign are not in the demo.
Tenant isolation (R8)	Postgres RLS; tenant-partitioned topics and object paths; cross-tenant leakage tests in CI; per-tenant keys	Every collection resolves to an owning tenant, and tenant-scoped readers return only that tenant's rows (`server/src/modules/platform/isolation.ts`). Regional keys follow the `{region}/{tenant_id}/...` pattern. DDL with RLS: `docs/architecture/ddl/graph-core.sql`.	`server/test/platform-isolation.test.ts` (the isolation report is clean and the test is not vacuous).
SOC 2 Type II	Controls mapped from day one; audit window opens in Phase 2	Change management through PR review and CI gates, the definition of done (`CLAUDE.md`), and incident runbooks (`docs/runbooks/`).	Not in the demo: there is no audit, readiness assessment or vendor management.
Legal posture	AGORA is a technology provider; merchants are merchants of record and controllers	The merchant's own checkout is always the human destination (signed handoff). AGORA never confirms a payment (R2).	`server/test/protocols.test.ts` (handoff round trip).
Marketing compliance (R6, R9)	Kernel-check gate; disclosure logging for every community or creator interaction; verified-buyer-only reviews; counsel-reviewed playbooks per market	Each pack lists prohibited claims per regulator (`packs/<id>/kernel.yaml`), and a claim-check gate blocks publishing (`server/src/modules/intel/content.ts`, `server/src/api/kernel.ts`). Review invitations go only to verified orders and carry a disclosure (`server/src/modules/growth/earned.ts`). The playbook schema forces `disclosure_required` on `earned.*` steps (`playbooks/playbook.schema.json`). Counsel sign-off for regulated packs is recorded per version (`packs/regulated-gaming/pack.yaml`, `packs/medical-practice/pack.yaml`). The reviewers are fictional.	`server/test/growth.earned.test.ts`, `server/test/intel.test.ts`, `server/test/packs.test.ts`.

Run the security checks locally:

node scripts/scan-pan.mjs
node scripts/scan-secrets.mjs
cd server && npx vitest run test/platform-r1.test.ts test/platform-isolation.test.ts test/trust.test.ts test/repo-scans.test.ts

Source: docs/security/README.md