Security Disclosures

Security is an architectural foundation at Sylvaxo, not an afterthought. We implement zero-trust boundaries, automated dependency CVE scanning, and strict principle of least privilege across all systems.

Core Security Controls

• End-to-end TLS 1.3 encryption across all internal and public network endpoints.
• Hardware security key MFA required for all developer accounts and production cloud clusters.
• Automated Dependabot and Snyk scanning in every pull request.
• Zero persistent plaintext credentials; automated HashiCorp Vault / AWS Secrets Manager injection.

Responsible Disclosure Program

If you discover a security vulnerability in any Sylvaxo platform, please email security@sylvaxo.com with steps to reproduce. We commit to acknowledging receipt within 12 hours.