Security software should be held to a higher standard.

Opsec is designed so that your code, findings and models never leave infrastructure you control.

Controls

How your data is protected.

Runs in your perimeter
All processing happens inside your deployment. There is no hosted control plane.
Read-only by default
Source access is read-only. Write access is requested only to open repair pull requests.
Local models
Model weights run on your hardware. Your code and findings are never used for training.
Encryption
Data at rest is encrypted with keys you manage. Service-to-service traffic uses mTLS.
Isolated replicas
Validation runs in a namespace with no route to production, and replicas are destroyed after use.
Audit log
Every action by an agent or user is written to an append-only log you can export.

Responsible disclosure

Step 1
Email security@runopsec.com with a description of the issue and steps to reproduce.
Step 2
We acknowledge every report within one business day and keep you updated until it is resolved.
Step 3
Please give us 90 days to ship a fix before public disclosure. We credit researchers who wish to be named.
Step 4
Testing must not degrade service for other users or access data that is not yours.