Security

Reporting a vulnerability

If you find a security issue in this site or in any Coherence Energy Labs™ software, email security@coherenceenergylabs.com with enough detail to reproduce it. You will get a human reply. Please give us a reasonable window to fix the issue before public disclosure; we will credit reporters who want credit.

Machine-readable contact details are published at /.well-known/security.txt.

How the site is built

The core site is static HTML and CSS served by a Cloudflare Worker. It ships no executable JavaScript and runs under a strict Content-Security-Policy with HSTS and frame denial. The interactive demos under /demos/ do run JavaScript to compute their visuals in your browser; they are served under a separate, scoped CSP and are isolated from the core site. The site stores no visitor data, and the attack surface is intentionally small.

Security program

Coherence Energy Labs™ maintains a documented information-security program covering identity, credentials, endpoints, model usage, incident response, and vendor risk. It is versioned alongside our source, reviewed annually, and reviewed again after any significant incident. Controls are recorded against dated evidence rather than asserted: a control is treated as in place only when there is a receipt for it.

Identity and access

• Phishing-resistant multi-factor authentication, using hardware security keys, on every account that administers company systems.
• Two-step verification enforced organization-wide at the corporate directory, not left to individual opt-in.
• Least-privilege role assignments, with documented joiner, mover, and leaver procedures and a quarterly access review.
• Administrative rights separated from day-to-day accounts.

Credentials and secrets

• Long-lived secrets held in an encrypted vault with threshold-based recovery, so no single stored artifact can disclose them.
• Per-service credentials, scoped to the minimum permissions the provider supports, with short lifetimes where available.
• Documented rotation and revocation procedures, with revocation verified against the provider rather than assumed.
• Automated, value-suppressing secret scanning in continuous integration.

Endpoints

• Full-volume disk encryption with recovery keys escrowed to managed enterprise storage.
• Centrally managed devices with automated compliance evaluation; access to sensitive work is limited to compliant devices.
• Endpoint protection with real-time monitoring and tamper protection, an enforced patch deadline, and an enforced inactivity lock.
• Hardware-backed platform security: TPM-resident keys and verified boot.

Model and API usage

• Model API traffic is routed through an authenticated gateway that records usage and retains it for retrospective review.
• Spending caps are set at the provider, and usage is reviewed on a quarterly cycle.
• Credentials are never transmitted inside prompts, and logs are not permitted to become a secret store.

Incident response

• A documented response process, modeled on NIST SP 800-61, defining severity levels, containment, evidence preservation, notification, recovery validation, and post-incident review.
• The process is exercised, not shelved: real incidents are run through the full lifecycle and closed with a written root-cause review and a class-level fix.

Email and domain integrity

Mail and DNS for this domain are hardened and publicly verifiable: SPF configured to hard-fail, DKIM signing, a published DMARC policy with aggregate reporting, MTA-STS with TLS reporting, and DNSSEC. Look-alike domains are registered and redirected to the canonical site.

Risk and vendors

We maintain an annual risk assessment with explicitly accepted risks, and a vendor register recording what each provider holds, how our side of the relationship is authenticated, and where assurance is missing.

Certifications and assurance

An external security review in June 2026 assessed our public web and email surface; the findings were remediated and the remediations independently re-verified.

Coherence Energy Labs™ does not currently hold SOC 2 or ISO 27001 certification. We consider it more useful to say so plainly than to imply equivalence: our program is documented and evidenced, and pre-engagement materials, including a risk assessment, change-management procedure, and vendor register, are complete. Prospective partners who require certification should contact us before relying on one.

Counterparties conducting security due diligence may request a summary of our control evidence at security@coherenceenergylabs.com. Detailed control documentation is shared under a mutual non-disclosure agreement.