Security audits

Re-scanned quarterly · every audit signed and timestamped

Aunova's position is that a control is something you can prove ran, not something a document asserts. Applying that to ourselves means publishing the security scans of our own code in the form we would want from a supplier: the tool's unedited output, the exact commit it ran against, every finding and what was done about it, signed with a key we publish and timestamped by something we do not control.

None of this is an assurance engagement, a penetration test or an endorsement by anyone. It is evidence, published so that it can be checked rather than believed, and each page carries the commands to check it. Each audit lives at its own dated path and is immutable once published: a superseded audit stays online and links forward to the one that replaced it, so nothing here quietly improves after the fact.

Published

• 27 July 2026aunova.ae3 findings, all fixedView report