CloudLab Works Trust

The security and openness checks this site and its open-source projects pass. Each one is issued by an independent body or tool, not by CloudLab Works, and each links to the issuer so it can be checked rather than taken on trust. Results are dated: a badge describes the day it was checked.

This website

• A+
  Mozilla HTTP Observatory: A+Mozilla · 120 of 100 points, 12 of 12 tests · checked 2026-11-02

  The site sends the security headers that stop common browser attacks: a strict content security policy, no framing by other sites, no MIME sniffing and a tight referrer policy.

  Verify with Mozilla →
• A+
  Qualys SSL Labs: A+Qualys · all four addresses · checked 2026-11-02

  Connections are encrypted with TLS 1.2 or 1.3 only. Older, weaker protocol versions are refused.

  Verify with SSL Labs →
• HSTS
  HSTS preloadedChromium HSTS preload list · status: preloaded

  Browsers know in advance to use HTTPS for this domain, so a first visit can never be downgraded to an unencrypted connection.

  Verify on hstspreload.org →
• RFC
  9116
  security.txtIETF RFC 9116 · published at the standard address

  Anyone who finds a security problem knows exactly where to report it.

  Read security.txt →

Our open-source code

• Best
  Practices
  OpenSSF Best Practices: passingOpen Source Security Foundation · oak-events, MCP Failure Lab, Agent Trace Clinic · earned 2026-11-02

  Each project meets the OpenSSF baseline for well-run open source: a public licence and contribution guide, a private way to report vulnerabilities, automated tests and linting on every change, and static security analysis.

  oak-events → · MCP Failure Lab → · Agent Trace Clinic →
• Score
  card
  OpenSSF ScorecardOpen Source Security Foundation · automated weekly · 2026-11-02: oak-events 5.8, MCP Failure Lab 6.6, Agent Trace Clinic 6.7 out of 10

  An automated check of supply-chain hygiene: pinned build dependencies, code scanning, a security policy, dependency updates. The scores are climbing; one check counts only after a repository is 90 days old.

  Live score: oak-events →
• MIT
  OSI-approved licenceOpen Source Initiative · MIT

  The code can be read, run, changed and reused by anyone, commercially or not.

  See the code on GitHub →
• Private
  reports
  Private vulnerability reportingGitHub · enabled on each project

  Security problems can be reported privately and fixed before they are made public, as each project's SECURITY.md explains.

  Read a security policy →

In progress

• STAR
  for AI
  CSA STAR for AI, Level 1Cloud Security Alliance · self-assessment being drafted, not yet submitted

  A public self-assessment of AI security controls against the CSA AI Controls Matrix, starting with oak-events.

• ISO
  5230
  OpenChain ISO/IEC 5230OpenChain Project · planned

  The international standard for an open-source licence compliance programme.

Report a problem

Found a security issue on this site or in any CloudLab Works project? Write to alex@cloudlabworks.dev, or use the private reporting option on the project's GitHub page. Reports are acknowledged within a week.