Security
Security is part of CARL's core product. This page summarizes our commitments; see the Privacy Architecture for the deeper technical write-up.
Reporting a vulnerability
Email security@wentzel.ai. We acknowledge within 24 hours and keep researchers updated through the fix. We credit researchers who follow responsible disclosure.
Controls
- Ephemeral containers with RAM-only scratch and 60-second lifetime.
- Outbound network allowlist during assessment.
- Encrypted OAuth tokens at rest; used once and discarded.
- Strict HTTP security headers (HSTS, CSP, X-Frame-Options, Permissions-Policy).
- Append-only audit log with container identifier and timestamps.
- Dependency audit gating and automated dependency updates.
Audit log
Every repository clone, assessment run, and report write emits an audit-log row. The log is append-only at the application layer.
Self-hosted option
Teams with stricter requirements can run CARL as a Docker image inside their own infrastructure. Code never leaves the customer environment.