What we have today, what we are working on, and what we have not yet earned the right to claim. Every line on this page is meant to be defensible to an auditor.
EXOCHAIN's web presence is split across three surfaces with hard separation. Each surface enforces its own auth and capability rules at the route boundary.
Statements here reflect implemented primitives at the time of writing. EXOCHAIN treats post-quantum readiness as a baseline and tracks evolving guidance. See /docs/security.
Coordinated disclosure intake is at /security. Provide reproduction steps and an intended public disclosure date; we will respond with an acknowledgement window and assigned severity.
AVC payloads are minimized by default. Consent records carry only a scope hash, not the underlying data. PII is not required to register an actor. Aggregate metrics shared with researchers are anonymized.