Security
How SCPN Studio is designed to minimise trust in the serving infrastructure and how to report vulnerabilities.
Audit summary
Latest dependency audit: 2026-07-09. Scope: SCPN-STUDIO Hub, commerce backend, and portal npm workspace.
npm moderate+
0
Findings from pnpm audit --audit-level moderate
Python Hub
0
Known vulnerabilities from pip-audit
Python backend
0
Known vulnerabilities from pip-audit
Status: No actionable moderate-or-higher findings remain.
Counts are captured from `pnpm audit --audit-level moderate` and `pip-audit` against the installed dependency tree. Vulnerabilities are triaged to patched versions via pnpm overrides; remaining surface is continuously monitored in CI.
Dependency status
Continuous supply-chain monitoring across the workspaces.
| Ecosystem | Scanner | Packages scanned | Known vulnerabilities | Cadence |
|---|---|---|---|---|
| npm (portal + workspaces) | pnpm audit | workspace tree | 0 | Every CI run |
| Python (Hub) | pip-audit | 48 | 0 | Every CI run |
| Python (commerce backend) | pip-audit | 48 | 0 | Every CI run |
How we reduce server trust
SCPN Studio is designed so that a compromise of the serving box does not silently validate false claims.
Offline root ceremony
The hybrid Ed25519 + ML-DSA-65 root key is generated offline and stored in a vault. The serving box holds no private key material.
Client-side seal verification
Evidence seals are verified in the browser against a pinned, signed keyring. A compromised server cannot mint a valid seal.
Claim-boundary rendering
Every scientific claim is rendered at its declared boundary. Bounded, roadmap, refuted, or retracted claims are never shown as validated.
Jailed studio deploy keys
Each studio deploys with an SSH key locked by rrsync to a single directory. A leaked key cannot escape its studio space.
Same-origin identity
The portal is the only identity surface. Studios inherit the session and never handle passwords or tokens themselves.
Transparency log
Published artifacts are entered into an append-only log with signed checkpoints, so silent alteration would break the proof.
Report a vulnerability
Do not open a public issue for security-sensitive findings.
Send vulnerability reports to security@anulum.li. Do not open a public issue for security-sensitive findings.
GitHub Security Advisories
For non-urgent issues you may also use the private advisory form on the scpn-studio repository.
Disclosure policy
- Reports are handled confidentially.
- We aim to acknowledge reports within 72 hours.
- We coordinate disclosure with the reporter before publishing details.
- Fixed vulnerabilities are documented in the changelog and, when applicable, in the transparency log.
Supply-chain ledger
Direct runtime dependencies of the SCPN Studio Hub and platform SDK.
This ledger lists the direct runtime dependencies we ship. Transitive development dependencies are excluded; the full dependency tree is available in pnpm-lock.yaml and in each Python package metadata.
| Package | Version | Ecosystem | Licence | Purpose |
|---|---|---|---|---|
| scpn-studio-platform | 0.11.0 | python | AGPL-3.0-or-later / commercial | Domain-neutral SDK for evidence, manifests, verbs, identity, jobs, and seals. |
| cryptography | >=41.0 | python | Apache-2.0 OR BSD-3-Clause | Ed25519 signing and general cryptographic primitives for the seal layer. |
| astro | 6.4.8 | npm | MIT | Static site generator for the public portal. |
| @astrojs/react | 5.0.7 | npm | MIT | React integration for Astro islands. |
| react | 19.2.7 | npm | MIT | UI library for the account app and Hub shell. |
| react-dom | 19.2.7 | npm | MIT | React DOM renderer. |
| @anulum/ui | workspace | npm | AGPL-3.0-or-later / commercial | Shared design tokens and UI primitives. |
| @anulum/verify | workspace | npm | AGPL-3.0-or-later / commercial | Standalone TypeScript seal verifier and CLI. |
| @module-federation/runtime | 2.5.1 | npm | MIT | Module Federation runtime for loading studio remotes in the Hub. |
| @noble/post-quantum | 0.6.1 | npm | MIT | Browser-side ML-DSA-65 verifier for the post-quantum seal back-end. |
Operations
How the SCPN Studio portal and workbench are deployed, monitored, and observed.
Static hosting scaffold
The portal is built in CI and reflected to the static host that serves www.anulum.org. GitHub Pages remains an optional, non-blocking mirror when repository Pages is enabled.
Health probes
The commerce API exposes /healthz for liveness and /health/ready (with /health as an alias) for readiness against the auth, mail, and billing databases. A scheduled workflow probes both endpoints every 15 minutes.
Error tracking scaffold
Sentry browser monitoring is conditionally loaded in the portal and workbench when PUBLIC_SENTRY_DSN is set at build time; when absent no third-party tracker is requested.
Service level objectives
Public targets for availability, latency, and studio run success. Breaches are surfaced by the scheduled health-check workflow and the /status page.
| Service | Objective | Window | Metric |
|---|---|---|---|
| Portal static hosting | 99.9% | 30 days | Origin serves www.anulum.org over HTTPS with a 2xx response. |
| Commerce API | p95 < 500 ms | 7 days | Response time for /health/ready and authenticated read endpoints. |
| Commerce API | 99.95% | 30 days | /health/ready returns 200 with all database checks reporting ok. |
| Hosted studio demo runs | 99% | 7 days | Deterministic demo runs on /studio/<slug>/demo/ complete and emit a bridge result message. |
Acknowledgements
We credit reporters who responsibly disclose valid vulnerabilities unless they request anonymity.
Read the full security policy on GitHub.