This page is the entry point for a buyer, integrator, or reviewer who wants to check security evidence without trusting a summary. Each row points at the file that produces or records the metric, and the machine-readable status lives in docs/security/external-validation.json. The status is dated 2026-11-05. A change to a status must update this page and that JSON record together.

What this page is for

• It names the gate or document behind each claim, so the claim can be reproduced from the repository.
• It labels self-assessments as self-assessments instead of presenting them as independent findings.
• It shows pending where evidence does not exist yet, including the external penetration test.
• It records the review date, so a stale assurance page is visible as stale.

What this page is not

• It is not an audit report. No accounting or security firm has reviewed the controls described here.
• It is not a certificate. The project holds no ISO/IEC 27001, SOC 2, or comparable certification, and the OWASP ASVS matrix is a mapping rather than a passed audit.
• It does not claim that SveltyCMS is safer than another product. No competitor is named or compared on this page, and no ranking is implied.
• It is not a substitute for testing your own deployment. Configuration, hosting, secrets, and integrations determine the effective posture of a running installation.

Compliance note

Security statements in this repository follow EU Directive 2006/114/EC on misleading and comparative advertising and German UWG §6. As of 2026-11-05, the rules applied here are:

• every factual claim is dated and links to a source that can be checked;
• self-assessments are labelled as self-assessments;
• no comparative claim is made about another product;
• missing evidence is shown as pending, not inferred from adjacent checks.

Evidence map

The status column describes what exists in this repository on 2026-11-05. Internal metrics are produced by project scripts and have not been independently reviewed.

Every row is checked by one command: bun run security:assurance (also part of bun run check and the CI whitebox job). --only=<id> runs a single check and --json prints a machine-readable summary.

Metric	Produced by	Current status (2026-11-05)
Patch latency	scripts/security/check-advisories.ts; published in patch latency	Self-assessed internal gate. No advisory has been published as of 2026-11-05: the table is empty by design, and provenance: "example" records are excluded from every count.
Advisories per fix (OSV / CVE)	Advisory process; ledger in scripts/security/check-advisories.ts, dependency data from scripts/security/scan-osv.ts	Process documented and enforced by the ledger gate. No public advisory exists yet; the first real record will carry the OSV/CVE ids.
Test strength (mutation score)	scripts/security/check-test-strength.ts; published in test strength	Self-assessed internal measurement. Floors are defined; no mutation run has been published yet.
Threat-model coverage	scripts/security/check-threat-model-drift.ts; docs/security/threat-model.json and threat models	Self-assessed inventory, machine-checked: 58/58 server route files (100.0%) covered as of 2026-11-05; not independently reviewed.
Supply chain (Scorecard/SLSA/Sigstore)	docs/security/external-validation.json; Scorecard runs in .github/workflows/scorecard.yml	pending — no Scorecard score, SLSA level, or Sigstore identity is recorded as of 2026-11-05.
Independent validation (pen test / bounty)	docs/security/external-validation.json	pending — no dated external penetration test and no live public bug-bounty programme as of 2026-11-05.

AI-assisted security

AI tools assist this project under rules that keep a human accountable for every fix:

1. AI may draft vulnerability triage notes, regression tests, threat-model entries, and advisory text.
2. A named human maintainer reviews and signs every security fix before merge. The signature is the approving review on the change request; automation does not approve security changes.
3. Model output is untrusted input. It is reviewed like any external contribution and is not merged without tests that demonstrate the fix.
4. No secrets, credentials, customer data, or private deployment configuration are sent to a model. Bootstrap secrets stay in config/private.ts and are not pasted into prompts, issues, or commits.

Open items

• External penetration test. No dated report by a party outside the project exists as of 2026-10-18. The JSON record stays pending until a report exists. See security posture.
• OpenSSF Scorecard. The scorecard.yml workflow is configured, but no score is recorded; the record stays pending until a run result is written into openssf_scorecard.latest_score.
• SLSA provenance. pending. The level is recorded when a verifiable build attestation exists.
• Sigstore signing. pending. The identity is recorded when release artifacts are signed.
• Bug bounty. pending. No public programme is live; the responsible-disclosure route in SECURITY.md remains open.
• Independent review of internal metrics. Patch latency, mutation score, and threat-model coverage are self-assessed samples. They are not an external audit.
• OWASP ASVS. The OWASP ASVS matrix maps controls to chapters; it is not a passed audit and not a certificate.
• Next review. last_reviewed_at in the JSON record is 2026-11-05; scripts/security/check-external-validation.ts fails when the review is more than 180 days old or a completed penetration test is more than 365 days old.

Reporting and disclosure

Report vulnerabilities through the private GitHub Security Advisory form or security@sveltycms.com. Reply and fix windows, the coordinated-disclosure timeline, and the supported scope are in SECURITY.md; operational handling is in incident response.