Security
Evidence integrity is the product. Here's how ProofLane protects it.
- API-key auth: Set PROOFLANE_API_KEY to require X-API-Key on every /api/* endpoint except /api/disclaimer, compared in constant time.
- Evidence hashing: Every evidence row carries an artifact hash; the auditor pack manifest lets anyone verify integrity.
- Fixture labeling: Mock-mode artifacts are permanently labeled artifact_source: fixture — test data can never masquerade as live evidence.
- Least-privilege collectors: Integrations use read-only OAuth scopes / tokens; credentials live in environment variables.
- Failure honesty: Unreachable APIs produce ERROR evidence, never fabricated PASSes.
- TLS at the edge: Terminate TLS at your reverse proxy; the API binds loopback by default.
Known limits (we'd rather you read them here)
- Control mappings are DRAFT pending independent compliance-advisor review.
- With no API key set, the API trusts the network — localhost or trusted proxy only.
Questions or a vulnerability to report? Contact us — security reports go to the top of the queue.
