Trust & status

The CI gates and supply-chain checks link out to their live GitHub Actions runs. That signal is external and unverified. The verifiable proofs are the isolation badge below and the trust pack.

RLS tenant-isolation harness (verifiable)

checking

Quality gate

external

biome · tsc · eslint · knip · unit · RLS · a11y

Open Quality gate runs

Provenance

external

SLSA build provenance + SBOM (signed, verified in-CI)

Open Provenance runs

CodeQL

external

CodeQL SAST

Open CodeQL runs

Semgrep

external

Semgrep SAST

Open Semgrep runs

gitleaks

external

gitleaks secret scan

Open gitleaks runs

Lighthouse

external

Lighthouse performance budgets

Open Lighthouse runs