Service-control evidence

This page exists because the product handles accounts and is designed to handle repository metadata and security evidence. It identifies implementation points that a reviewer can inspect. It does not claim a certification, legal compliance, successful production configuration, or effectiveness of a control that has not been exercised in the target environment.

The product proof model is documented separately in Core concepts. A service control does not turn a candidate into a confirmed finding.

Audit chain

src/libs/AuditChain.ts defines append and verification operations for a per-organization SHA-256-linked event chain. The database-side mutation guards are in migration 0016-audit-chain. The read-only verifier is src/scripts/audit-verify.ts. These mechanisms provide tamper-evidence within the stated chain model; they are not an external audit or certification.

GDPR export

The account export action is in src/actions/account.ts, and the collection, compression, storage, expiry, and notification job is in src/jobs/account.ts. Availability of the resulting download depends on the configured jobs, storage, and email adapters. Review those deployment integrations before treating the flow as operational.

Account deletion

src/actions/account.ts schedules account deletion with a 30-day grace period and supports cancellation by token. The scheduled deletion handler is in src/jobs/account.ts and its schedule is registered in src/jobs/registry.ts. A deployed cron must actually invoke that registry for deadlines to be processed.

RBAC

Organization membership roles are owner, admin, and member. Sensitive server actions re-check membership and role; hiding a dashboard control is not the authorization boundary. The access-control inventory is docs/architecture/ACCESS-CONTROL-CLASSIFICATION.json.

PAT

Personal access-token records use hash storage, optional organization scope and expiry, and revocation state in the authentication schema. Review the live API route's authentication classification before relying on a token for a specific operation; the presence of the table does not make every route token-enabled.

Idempotency

src/libs/Idempotency.ts implements an optional Idempotency-Key replay contract, but no live application route currently calls Idempotency.handle(). The Stripe webhook performs a separate event-ID dedup against the same idempotency_keys table. Do not describe generic route idempotency as deployed until a mutating route mounts the wrapper.

CSP

next.config.ts defines production-only Content Security Policy and related security headers. Development omits the CSP for the framework's development runtime. A reviewer should inspect the deployed response headers; configuration source alone does not prove an intermediary retained them.

Security txt

src/app/.well-known/security.txt/route.ts renders the disclosure document. SECURITY_CONTACT_EMAIL and SECURITY_POLICY_URL are optional and have placeholder/default behavior. Operators must set and verify real production values before presenting the route as a valid security contact.

Two factor

The codebase contains TOTP enrollment and challenge flows, backup-code handling, and step-up checks for classified sensitive actions. The policy inventory is docs/architecture/SENSITIVE-ACTION-POLICY.json. This is an implementation reference, not a claim that every possible sensitive action has passed an independent access-control review.

Sessions

The settings surface lists the user's authentication sessions and exposes revocation for sessions owned by that user. Session behavior should be re-verified after any authentication-provider or schema change.

Sentry

Sentry instrumentation is configuration-dependent. Without the relevant DSNs, error capture is not active; source integration must not be presented as production monitoring evidence without a received-event check.

Analytics

PostHog initialization is configuration-dependent. Its presence does not prove consent, residency, retention, or any other privacy property. Those require separate configuration and verification.

Residency

DATA_RESIDENCY_REGION is an operator-declared value. It does not discover or enforce the physical regions used by the database, storage, email, logs, or subprocessors. Compare the value with provider configuration before publishing a residency statement.

Retention

DATA_RETENTION_DAYS declares a period. A declared number is not evidence that a deletion sweep covers every applicable table. WORM and legally retained rows also require separate handling. Verify scheduled deletion behavior and table coverage against the deployed database.

Evidence

src/libs/Evidence.ts implements weighted completeness checklists for records, and the dashboard can display the resulting score. Completeness means that configured checklist items are marked present; it does not validate the truth of an artifact and is not the sandbox oracle used by Deton's confirmed verdict.

Review order

For a deployment review:

1. verify actual environment configuration and response headers;
2. execute account export, deletion cancellation, session revocation, and step-up flows in that environment;
3. run the audit-chain verifier against the deployed database;
4. verify scheduled jobs are invoked, not merely registered;
5. review GitHub access before repository integration;
6. keep all service-control conclusions separate from Deton's proof verdicts.