Cryptographic Trust & Guardrails
How HadayaLab enforces supply-chain quarantine without risking customer source confidentiality or license contamination.
Guardrail R1: Clean-Room License Isolation
HadayaLab only incorporates commercial-safe open-source software licensed strictly under MIT, Apache-2.0, BSD-3-Clause, or ISC. All proprietary metering, attestation signing, and credit-wallet logic reside strictly in the perimeter Cloudflare Workers layer, preventing license contamination of downstream systems.
Guardrail R2: Defensive Remediation Only
We deal exclusively with defensive quarantine, virtual patching, and remediation engineering. Proof-of-concept exploit distribution and weaponized offensive tools are permanently rejected from all HadayaLab platforms and repositories.
Guardrail R3: Zero-Exfiltration Client Sandbox
Register 1 AST inspection operates under an enforced Content Security Policy of connect-src 'none'. Your source code, lockfiles, and environment parameters cannot leave the client browser. No customer code is ever logged, stored, or transmitted to any remote server during initial triage.
DSSE Ed25519 Cryptographic Envelope
Every CycloneDX 1.6 SBOM and Attestation Report is wrapped in a Dead Simple Signing Envelope (DSSE) in accordance with the in-toto Statement v1 specification. Signatures are generated using our dedicated Ed25519 keypair and can be independently verified on our public key gateway.