Burhuc AI Labs / Engineering reference
A scoped inventory of implemented controls, the repository evidence available for review, and the deployment conditions that remain outside those tests.
01 / Inventory
The inventory distinguishes code-level implementation from deployment assurance. A repository test can show that a control behaves as expected in its tested conditions; it cannot establish that every production path, configuration, or operator process is covered.
RS256 token signing, issuer and audience checks, scoped actions, JWKS publication, and key rotation support.
Authentication, key-manager, scope, and gateway-route regression tests.
Production key custody, identity proofing, and operational rotation procedures require deployment evidence.
Protected user routes, secure session handling, revocation checks, and local-only static administration by default.
Session-cookie, protected-route, proxy-boundary, and admin-access tests.
Reverse-proxy configuration, operator access, device security, and incident response are deployment responsibilities.
Actor-aware rate limiting separates public browsing, authentication, registration, and evaluation workloads.
Rate-limit unit and route tests for configured application buckets.
Capacity, distributed enforcement, denial-of-service resilience, and upstream filtering are not proven by application tests.
Canonical path containment, constrained tool execution, task fixtures, and sandbox policy checks.
Traversal, sandbox, task, and external-tool protocol tests.
Repository controls do not by themselves prove operating-system, container, tenant, or infrastructure isolation.
Configured egress policy, destination checks, and controlled external-service use in supported execution paths.
Egress, provider-adapter, and connector-policy regression tests.
Network-layer enforcement depends on the deployed proxy, firewall, DNS, credentials, and complete routing coverage.
Dependency metadata, vulnerability lookup support, component inventory, and reproducible evidence artifacts.
SBOM, dependency-policy, reproducibility, and artifact-integrity checks.
Scanner availability, source provenance, build infrastructure, transitive risks, and remediation remain operational concerns.
Structured audit events, integrity-chain validation, fail-closed error paths, and signed evidence contracts.
Audit-chain, evidence-contract, signature, and independent-verifier tests.
Integrity checks detect defined changes; they do not provide immutable storage, universal non-repudiation, or complete event coverage.
Content security policy, security headers, constrained static routing, protected pages, and withdrawn-claim handling.
Header, static-page, injection-sink, and public-claim regression tests.
These controls cover the delivered web surface, not client devices, extensions, upstream compromise, or every browser behavior.
02 / Reference mappings
The references below help engineers organise review questions. They are not a control-by-control assessment, certification, accreditation, or conclusion that CertentIQ or a deployment satisfies the named framework.
Identity-aware access, least privilege, explicit trust decisions, and policy enforcement are useful review themes for gateway and runtime boundaries.
Version control, dependency review, secure development evidence, change governance, and vulnerability response inform repository practices.
Authentication, session management, access control, input handling, logging, and configuration themes inform web and API review.
Prompt injection, sensitive-data exposure, excessive agency, supply-chain risk, and tool misuse inform selected adversarial tasks.
Build provenance, component inventories, dependency integrity, and release controls inform supply-chain evidence design.
03 / Evidence levels
Security language becomes misleading when implementation, deployment, and independent assessment are collapsed into one status. CertentIQ reports them separately.
Source code, contracts, configuration defaults, tests, generated artifacts, and commit history for the reviewed revision.
Topology, secrets custody, network enforcement, monitoring, access reviews, backups, incident response, and retained logs.
External architecture review, threat modelling, penetration testing, conformity assessment, remediation, and retest.
04 / Current limits
Only qualified, scoped review can support stronger conclusions.
Use the evaluation overview for behavioural testing methodology, or inspect public records that satisfy current evidence and publication gates.