{"schema":"quox.evidence.item/1","id":"cycle:5","kind":"cycle","claim_id":null,"statement":"Governed discovery on real deployments (2026-09)","not_claimed":"Not an independent third-party audit, and not a claim that no other issues exist.","status":"published","status_note":"3 published finding(s); 3 open, 0 fixed at publication.","computed_status":null,"status_history":[],"independent":{"kind":"self","note":"Issued by Quox about Quox systems (or customer sites tested under proof of control); signed by the Quox publisher key; not audited by a third party."},"issuer":"Quox","dates":{"first":"2026-09-26T22:59:54.058Z","latest":"2026-09-27T00:56:11.044Z","as_of":"2026-09-27T00:56:11.044Z"},"freshness":{"staleness_days":null,"stale":null,"expires":null,"as_of":"2026-10-23"},"evidence":[{"type":"artifact","url":"/evidence/securityAudits.json","label":"Signed security audit log (quox.security-audit-log.v1)"},{"type":"page","url":"https://quox.ai/security","label":"The /security audit band"}],"limitations":"Customer identities are redacted; the receipts, scope and severities are not. Quox tested these sites under proof of control; this is not an independent audit.","cannot_establish":"A valid signature proves this record is authentic and unmodified; it does NOT prove the system behaved correctly. It does not establish that the findings are complete, correctly graded, or that no other issues exist.","open_findings":["finding:FND_01M3G1G6TYKA3WFN5F4RKA3WFN","finding:FND_01M3G3GG3P6CWT0SPZG26CWT0S","finding:FND_01M3G5BW6NSJWYZ6P1Z1SJWYZ6"],"withheld_findings":0,"capabilities":["security-audit","customer-engagement"],"verify":{"method":"ed25519-log","artifact_url":"/evidence/securityAudits.json","receipt_url":null,"public_key":"fIQ/oPZSVq30nXqR5yU0Ny47QhHVNrD/PDqxkoIyEck=","public_key_source":"committed in the repository (scripts/security-audit-public-key.mjs) and in public/evidence/quoxtrust-verify.mjs","locator":{"file":"/evidence/securityAudits.json","path":"cycles[4]","cycle":5},"verifier_cmd":"node quoxtrust-verify.mjs ./securityAudits.json","reproduction":"Download /evidence/securityAudits.json and /evidence/quoxtrust-verify.mjs (dependency-free, Node 18+). Run the verifier command. It recomputes every WARD receipt chain_hash under the published recipe and verifies the Ed25519 signature over the canonicalized log with the committed public key. Exit 0 means authentic and unmodified; it does not mean the findings are complete or correct.","browser_verifiable":true},"citations":[{"url":"https://quox.ai/security","label":"Quox security audit log"}],"detail":{"cycle":5,"cycle_kind":"customer-engagement","engagement_id":"ENG_01M3FZ4KHVNC5JCEYTXTNC5JCE","scope":["client-a.example","client-b.example","quox.ai"],"method":"Per target: proof-of-control first (a DNS TXT record or a .well-known challenge the target must serve), then a governed discovery-tier scan (subfinder host discovery + httpx port/service discovery) executed through the collector's engagement-anchored bastion approval-grant. Discovery tier only: no intrusive, credentialed, or exploit tooling. Findings graded against the actual scan output and confirmed where the evidence was direct.","summary":"The first governed security engagement Quox ran on real customer production sites, not on itself. Three verified production properties were scanned: two external customers (a VPN provider and a hot-tub retailer, redacted here as client-a / client-b) and quox.ai (our own). Every target proved control before any scan ran, every scan passed the same governed approval-grant path as any other risky action, and every step is WARD-witnessed. Findings are published at their honest severity: one low (an internet-exposed hosting control panel with its version disclosed) and two informational (a publicly-discoverable dev subdomain; a customer-named subdomain on our own site). Client identities are redacted; the receipts, scope and severities are not. This band grows over time as more deployments are scanned.","controls_held":["Complete mediation held: every scan minted and presented a bastion approval grant scoped to the exact command and target host; an out-of-scope subdomain probe was refused by the scope gate, not executed.","Fail-closed held under real load: when the grant-mint policy callback timed out, the scan was refused rather than run ungranted.","Proof-of-control enforced before any scan: a target that had not proven control (DNS or well-known challenge) could not be scanned.","Discovery-tier ceiling enforced: production engagements cap at discovery, so no intrusive or exploit tooling ran against a live customer site."],"totals":{"critical":0,"high":0,"medium":0,"low":1,"fixed":0,"open":3,"refuted":0,"info":2},"ward":{"chain_id":"ward:org/quox/env/production","hash_recipe":"sha256(prev_chain_hash|chain_id|seq|ward_entry_id|witnessed_at|source_kind|source_id|payload_hash), hex","receipts":2}},"human_url":"/evidence/explore#cycle:5","machine_url":"/evidence/items/cycle:5.json","api_url":"/api/evidence/cycle:5","contract":{"authentic_is_not_correct":"A valid signature or a recomputed hash proves a record is authentic and unmodified. It does not prove the system behaved correctly or that a finding list is complete.","independence":"self = issued by Quox and recomputable by anyone, not audited by a third party. visitor-recomputable = the reader recomputes it offline from published material. external = an outside party issued or hosts the primary record. Quox-verified is never independently verified.","curated_status":"status OWNER-APPROVED means the owner approved the wording for publication. It is not a computed VERIFIED status. computed_status, where present, is computed from proof-engine runs and is reported separately.","verify_caveat":"authentic != correct. A valid signature proves this record is authentic and unmodified; it does NOT prove the system behaved correctly."}}