How Conformant secures Conformant.
A trust registry earns exactly as much trust as its own conduct. This page documents how the scanner behaves, how report integrity works, and how to reach us when something is wrong.
Scanner conduct
The public scanner performs the standard MCP client handshake (initialize, notifications/initialized, tools/list) against publicly reachable endpoints and never calls tools/call. Nothing is exploited, nothing is modified, no access control is circumvented. Private address space is blocked, scans are rate-limited per IP, and no credentials are ever requested or stored by the public scanner.
Report integrity
Every report's canonical body is hashed with SHA-256 and the digest is anchored to the Sigstore/Rekor public transparency log at issue time. To verify a report independently: recompute the canonical hash from the report body, then compare it with the Rekor entry at the log index printed on the report. No Conformant account is required to check us.
Platform posture
conformant.io ships strict security headers: a restrictive Content-Security-Policy, Strict-Transport-Security with preload, X-Frame-Options DENY, nosniff, and a locked Permissions-Policy. Payments are processed by Stripe; card data never touches Conformant infrastructure.
Reporting a vulnerability
Email security@conformant.io or use the machine-readable contact in /.well-known/security.txt. Grade disputes and re-scan requests follow the coordinated-disclosure policy; demonstrated false positives are corrected within 48 hours with an anchored retraction.