THREATBYTESTM research
Research security
Security design isolates analysis in sandboxes, protects credentials, and routes responsible disclosure through documented channels. Public forms do not accept exploit delivery.
Disclosure01
Use documented security contact channels for vulnerability reports unrelated to quarantined specimen submission workflows.
Specimen handling02
Public pages already show hashes, metadata, and aggregates only. The analysis pipeline must meet these requirements before it handles live specimens:
- Specimens are held in restricted, encrypted storage and are never downloadable from public pages.
- Analysis runs in disposable, hardened, resource-limited sandboxes with networking disabled or simulated.
- Output from analysed files is treated as untrusted and parsed inside the sandbox.
Platform controls03
Controls required for the backend stage:
- Role-based access enforced on every workspace page and API operation, from a single permission matrix.
- Separate credentials for the analysis engine, with no direct database access.
- Audit logging of sign-ins, role changes, approvals, and data exports.
- Secrets kept out of source control and rotated when exposure is suspected.