Security Exhibit

Summary of commercial security controls, token handling, license signing, output integrity, scan scope, and the incident process.

1. Purpose

This exhibit summarizes security controls relevant to aisecurity.llc commercial programs, including OEM, reseller, MSSP, enterprise, private-label, white-label, offline, and air-gapped deployments.

2. Security Model

aisecurity.llc products may operate through several deployment models:

SaaS control plane
local desktop or CLI worker
OEM sidecar
partner-managed service
private worker
offline worker
air-gapped deployment

Security controls vary by deployment model.

3. Identity and Access

The platform should govern:

human users
organizations
memberships
roles
invitations
customer organizations
partner organizations
worker devices
API keys
license grants

Non-human devices should use service-issued worker or device tokens rather than long-lived human sessions.

4. License Controls

Commercial deployments may use:

signed license files
signed entitlement grants
partner identifiers
customer organization identifiers
enabled module lists
expiry dates
usage limits
offline limits
feature flags
revocation checks
output watermarks
version metadata

5. Binary Protection

Binary theft cannot be made impossible. The objective is to make unauthorized copying commercially useless.

Recommended controls:

signed binaries
partner-specific build metadata
signed license grants
customer-org entitlements
output watermarking
version and license status commands
revocation checks on sync
feature-gated modules
contractual audit rights
no unrestricted raw rule-pack redistribution

6. Local API Security

If a local HTTP sidecar is used, it should:

bind to localhost by default
require a local API token where practical
avoid unauthenticated network exposure
reject unauthorized targets
enforce resource limits
support cancellation and timeouts
avoid arbitrary shell execution
redact sensitive data from logs by default
expose health and version endpoints safely

7. Scan Scope

Customers and partners are responsible for ensuring scan targets are authorized.

Scan scope should define:

approved targets
prohibited targets
rate limits
test accounts
production restrictions
customer authorization
data-handling expectations
retention expectations

8. Output Integrity

Outputs should preserve:

engine version
rule version
scan timestamp
target identifier
finding identifiers
evidence references
license or partner metadata where appropriate
output hash where practical
watermark identifier where licensed

9. Secrets and Sensitive Data

The system should avoid exposing secrets in logs, reports, telemetry, and support bundles.

Where findings contain sensitive evidence, outputs should support redaction, truncation, or customer-controlled retention.

10. Audit Events

Commercially relevant events may include:

worker pairing
license activation
entitlement check
usage event
scan start
scan completion
artifact export
report export
license revocation
failed authorization
support access

11. Update Security

Updates should support:

versioned binaries
checksums
signatures where feasible
release notes
compatibility notes
security advisories
controlled update channels for private and air-gapped deployments

12. Incident Response

Customers and partners should notify aisecurity.llc of suspected security incidents involving:

license keys
worker tokens
unauthorized redistribution
customer data exposure
vulnerability in the engine
unsafe output handling
compromised partner integration

13. Shared Responsibility

aisecurity.llc is responsible for its software, license controls, support commitments, and platform systems within agreed scope.

Partners and customers are responsible for authorized scanning, environment security, credential protection, first-line customer support where applicable, and use within the agreed license scope.