{"schema":"quox.evidence.item/1","id":"claim:registry_claims.security_self_audit","kind":"claim","claim_id":"quox.security_self_audit.v1","statement":"Quox runs governed security scans against its own production surface and publishes the findings, both fixed and still open.","not_claimed":null,"status":"OWNER-APPROVED","status_note":"Owner-approved wording for publication. This is owner-curated, not a computed VERIFIED status.","computed_status":null,"status_history":[],"independent":{"kind":"self","note":"Issued by Quox; not independently verified."},"issuer":"Quox","dates":{"first":"2026-09-28","latest":"2026-09-28","as_of":"2026-09-28"},"freshness":{"staleness_days":30,"stale":false,"expires":"2026-10-28","as_of":"2026-10-23"},"evidence":[{"type":"page","url":"https://quox.ai/security","label":"Findings from the 2026-09-28 DRAGO discovery scan of quox.ai are filed as tracked issues and projected onto /security. Two are already fixed and closed (X-Powered-By #632, legacy TLS 1.0/1.1 #631); the open ones are listed below."}],"limitations":"This is Quox auditing Quox. An independent third-party security audit is a stated next step, not yet done.","cannot_establish":"A valid signature proves this record is authentic and unmodified; it does NOT prove the system behaved correctly. This is Quox auditing Quox; the signed log proves what was published, not that the audit found everything.","open_findings":["https://github.com/quoxai/quox/issues/633","https://github.com/quoxai/quox/issues/634"],"withheld_findings":0,"capabilities":["security_self_audit"],"verify":{"method":"ed25519-log","artifact_url":"/evidence/securityAudits.json","receipt_url":null,"public_key":"fIQ/oPZSVq30nXqR5yU0Ny47QhHVNrD/PDqxkoIyEck=","public_key_source":"committed in the repository (scripts/security-audit-public-key.mjs) and in public/evidence/quoxtrust-verify.mjs","locator":{"file":"/evidence/securityAudits.json","path":"cycles","claim_id":"quox.security_self_audit.v1"},"verifier_cmd":"node quoxtrust-verify.mjs ./securityAudits.json","reproduction":"Download /evidence/securityAudits.json and /evidence/quoxtrust-verify.mjs (dependency-free, Node 18+). Run the verifier command. It recomputes every WARD receipt chain_hash under the published recipe and verifies the Ed25519 signature over the canonicalized log with the committed public key. Exit 0 means authentic and unmodified; it does not mean the findings are complete or correct.","browser_verifiable":true},"citations":[{"url":"https://quox.ai/security","label":"Quox"}],"detail":{"path":"registry_claims.security_self_audit"},"human_url":"/evidence/explore#claim:registry_claims.security_self_audit","machine_url":"/evidence/items/claim:registry_claims.security_self_audit.json","api_url":"/api/evidence/claim:registry_claims.security_self_audit","contract":{"authentic_is_not_correct":"A valid signature or a recomputed hash proves a record is authentic and unmodified. It does not prove the system behaved correctly or that a finding list is complete.","independence":"self = issued by Quox and recomputable by anyone, not audited by a third party. visitor-recomputable = the reader recomputes it offline from published material. external = an outside party issued or hosts the primary record. Quox-verified is never independently verified.","curated_status":"status OWNER-APPROVED means the owner approved the wording for publication. It is not a computed VERIFIED status. computed_status, where present, is computed from proof-engine runs and is reported separately.","verify_caveat":"authentic != correct. A valid signature proves this record is authentic and unmodified; it does NOT prove the system behaved correctly."}}