--- title: "Security assurance" description: "Review status, operational security limits and how to report a vulnerability." canonical_url: "https://docs.oz0.ai/concepts/security/assurance" --- # Security assurance > Review status, operational security limits and how to report a vulnerability. For: operators assessing a deployment's security. Orchestrator Zero has not had an independent security review or penetration test. Automated checks do not establish that independent assurance. Assess the [security model](https://docs.oz0.ai/concepts/security) and [threat boundaries](https://docs.oz0.ai/concepts/threat-model/known-gaps) before relying on a control. ## Deployment boundaries The threat model explains the scope of each control, including management's certificate authority, tenant payload access from nodes, tier-0 execution, webhook responses and retained API keys. Put workloads that must not share payload access in separate tenants. Labels do not provide that separation. Keep sandbox and credential requirements beside the configuration that enforces them: [sandbox tiers](https://docs.oz0.ai/concepts/security/sandbox-tiers), [protected files](https://docs.oz0.ai/concepts/security/protected-files), [egress](https://docs.oz0.ai/concepts/security/egress) and [credential injection](https://docs.oz0.ai/admin/credential-injection). ## Quota accounting after a crash Usage rows and owner or team quota charges are separate writes. Outstanding durable reservations and saved retries repair missing charges, applying each charge once. A crash can still lose a charge when no recovery record survives: an unreserved call interrupted between its usage and quota writes, for example, or a failed charge kept only in memory. Failed metering writes are retained on disk when the metering directory is available. An orderly stop retries them for up to five seconds and logs writes left for the next start. If that directory cannot be opened, retries use memory and may be lost on shutdown. Review usage and quota totals after an unclean stop. This limitation remains open. See [Contracts and limits](https://docs.oz0.ai/build/parts/contracts-and-limits) for enforcement during a run. ## Runtime selection by an edge For released node builds, rolling back to an older release requires a rollback allowance signed by management. Development builds without an ordered release version can move freely. Within an accepted release, the edge selects the runtime so that rollouts can roll back. An attacker controlling an edge can select an older runtime still listed by an accepted signed release. They cannot select one absent from every signed release that the node accepts. See [Release verification](https://docs.oz0.ai/fleet/upgrades/release-verification). ## Error records and source text Internal errors returned by the runtime and admin APIs, node and join routes, connection pages, streams, uploads and diagnostic reports use fixed wording; the server log retains the cause. Refusals still explain the input that was rejected. Job steps can record provider or plugin answers, and errors from a source the caller selected can quote that source. Previously recorded failed changes keep their existing text. Account for those records when deciding who may read job content and logs. ## Release verification Releases use the release key and include SBOMs and SLSA provenance. Keyless Sigstore signing and GitHub build attestations are not available. Follow [Check a release](https://docs.oz0.ai/fleet/releases#check-a-release) to verify the artifacts that are supplied. ## Report a problem Email [security@oz0.ai](mailto:security@oz0.ai) with `[security]` at the start of the subject. Describe the affected version, configuration, impact and steps to reproduce. Do not publish exploit details in an issue or pull request. Reporting does not require repository access. Security : [Read the current guidance](https://docs.oz0.ai/concepts/security/assurance#deployment-boundaries). Independent assurance is pending : [Read the current guidance](https://docs.oz0.ai/concepts/security/assurance). Trust-boundary gaps remain tracked : [Read the current guidance](https://docs.oz0.ai/concepts/threat-model/known-gaps). A crash can leave a quota charge unwritten : [Read the current guidance](https://docs.oz0.ai/concepts/security/assurance#quota-accounting-after-a-crash). An edge can select an older listed runtime : [Read the current guidance](https://docs.oz0.ai/concepts/security/assurance#runtime-selection-by-an-edge). Some error records retain source text : [Read the current guidance](https://docs.oz0.ai/concepts/security/assurance#error-records-and-source-text). Public signing logs wait for a public repository : [Read the current guidance](https://docs.oz0.ai/concepts/security/assurance#release-verification). ## Sitemap See the full [sitemap](https://docs.oz0.ai/sitemap.md) for all pages.