Documentation

Security

Verify releases, understand satellite publication and inspect the project security evidence.

In this section

3 articles

Osps Baseline Compliance

Review Stackweaver's OSPS control evidence, audit access requirements and known gaps without confusing source observations with conformance.

Sync Architecture

Understand the satellite publication path, signing identities, enforced checks and limits of the public audit evidence.

Verifying Releases

Verify container images, Helm charts and sync commits with the expected Sigstore workflow identity, immutable digest and attestation type.

Review the evidence

The guides distinguish publicly inspectable artifacts and source from settings or review records that require maintainer access. An API access error alone is not proof of a security problem.

Internal access policies, vulnerability runbooks and audit workbooks are operational records and are not published here. For suspected vulnerabilities, follow the organization-wide security policy and use its private reporting route.

Using the API
Previous
osps baseline compliance
Next