Scope is explicit
Repositories, cloud accounts, domains, applications, assets, and any authorized actions are scoped and approved independently.
How we protect the engagement
Security you can inspect
before access is granted.
See how WEFT Security handles authorization, access, data, testing, evidence, and customer-controlled changes before work begins.
Delivery principles
Clear boundaries before security work starts.
These are engagement and technical boundaries, not certification claims. They describe how we separate scope, evidence, authority, and enforcement.
Evidence stays attributable
Tool versions, rulesets, coverage states, scan scope, artifact validation, policy results, and material decisions stay attached.
Unknown stays unknown
Failed, missing, stale, partial, manual, and not-applicable coverage cannot silently become passing evidence.
Actions require authority
Explicit permissions, approvals, change owners, cancellation paths, and audit evidence govern changes.
Work runs in isolation
Source, DAST, cloud, container, and runtime workflows use bounded workers with separate credentials and execution limits.
Sensitive output is reduced
Normalized evidence is allowlisted and redacted; raw source and workload traffic are not centralized by default.
Source and data handling
Move only what the work requires.
Local or customer-hosted execution can keep source and broader scanning beside private systems. Reports and shared evidence are reduced to what the team needs to understand and fix risk.
Customer boundarySource · cloud · workloads
→Approved workManual and bounded tools
→Useful outcomeReviewed, redacted evidence
Control boundaries
Different data. Different checks. Different authority.
Temporary workspaces
Where hosted review is used, cloned repositories are removed after the job and reports retain bounded evidence rather than raw source.
Project-scoped identity
Cloud work uses an explicit approved scope and customer-controlled or short-lived identity wherever practical.
Enforcement stays local
Gateway, WAF, rate-limit, and runtime detection controls can run beside customer workloads.
Approval stays explicit
Tool access never bypasses the agreed scope, customer role, change owner, or approval path.
Operational assurance
Trust also depends on how change and failure are handled.
These practices describe current engineering behavior. They are not substitutes for an independent audit, certification, or customer-specific security review.
Release integrity
Scanner binaries, container images, rulesets, and generated manifests use explicit versions, digests, or hashes so upgrades are reviewable events.
Failure stays visible
Readiness, worker health, integration delivery, coverage errors, stale evidence, and partial scans remain distinct from passing state.
Vulnerability reporting
Security concerns can be reported directly to jawad@weftsecurity.com. Include reproducible impact without sending secrets or customer data.
Report a security concern →Trust questions
Clear answers before access is granted.
Need a customer-specific data-flow review?
Discuss your boundaryDoes WEFT Security claim compliance certification?
No. We can organize technical evidence against supported frameworks, but do not present that evidence as certification, legal compliance, or an auditor's conclusion.
Does source code have to leave our environment?
Supported local SAST and secret scanning can run through the local MCP process. Hosted workers use temporary workspaces and retain bounded evidence rather than repository contents.
What data is excluded from runtime events?
Request bodies, headers, cookies, authorization values, raw Falco output, command lines, and event arguments are not accepted by the runtime event contract.
How should we report a vulnerability?
Email jawad@weftsecurity.com with the affected surface, reproduction steps, and impact. Do not include production secrets, personal data, or destructive proof.
Evaluate the real boundary
Bring your architecture and constraints.
We will explain how the work fits, which data moves, and which controls and decisions stay in your environment.