Bay Run security

Implementation-backed security controls, reporting instructions, and explicit assurance limits.

Machine-readable form: https://run.huggingbay.xyz/security

{
  "build": {
    "binding_status": "complete",
    "generated_at": "2026-10-16T05:37:27Z",
    "image_digest": "sha256:35d717008d59bb49f14a1bc77de38a72abdd9d3a80cbfe9bc5a45516e89a4a63",
    "source_sha": "38573a833e2a2574b103018fc4e23b25b391bd69"
  },
  "related_surfaces": {
    "assurance": "https://run.huggingbay.xyz/.well-known/assurance.json",
    "data_policy": "https://run.huggingbay.xyz/.well-known/data-policy.json",
    "security_txt": "https://run.huggingbay.xyz/.well-known/security.txt"
  },
  "reporting": {
    "contact": "mailto:security@huggingbay.xyz",
    "contact_status": "published_not_release_verified",
    "instructions_url": "https://run.huggingbay.xyz/security",
    "limitation": "The organization publishes a dedicated security mailbox, but this release did not independently verify mailbox delivery, alerting, or monitoring. Bay Run does not claim a response-time SLA, independent triage certification, or encrypted-mail key. Do not use task, memory, catalog-request, or payment routes to submit reports.",
    "monitored_mailbox": null,
    "monitoring_evidence": "not_independently_verified_by_release",
    "next_actions": [
      "Email a minimal report to security@huggingbay.xyz; do not include credentials, secrets, or unrelated private task data.",
      "Record the release_id, generated_at, endpoint, and status from the relevant public document.",
      "Coordinate a secure transfer method with the security contact before sending sensitive proof material or exploit payloads."
    ],
    "organization_security_page": "https://run.huggingbay.xyz/security",
    "public_intake": true
  },
  "schema": "bay-run.security-policy.v1",
  "self_assessment": {
    "assessment_type": "implementation-backed self-assessment",
    "certifications_claimed": [],
    "independent_security_audit_completed": false,
    "penetration_test_claimed": false
  },
  "service": "bay-run"
}