Security

Who answers for it

Guðmundur Bjarni Ólafsson, Vakna’s founder, is the executive accountable for security: the program, the answer to every report, and the response when something goes wrong. Write to security@vakna.com and it lands on that desk.

What we’re protecting

Vakna runs code for agents in isolated boxes. The code in a box is untrusted by design: we assume it’s hostile to the machine it runs on, to every other box, and to whatever it can reach. Keeping it in is the product.

• Every box has its own kernel. It never shares one with the machine it runs on or with another box.
• Nothing a box says about itself is taken on trust. The rule is that identity and authority come from our side of the line, never from the box.
• The standard for testing the boundary is to act as a hostile box would. A test written to pass is not evidence.

Reporting a weakness

If you find a weakness in Vakna, in this site or in anything we run, write to security@vakna.com. Say what you found, how to reproduce it, and what it reaches. That address is the one in our security.txt too.

We answer within 3 business days, keep you posted while we fix it, and tell you when it’s done.

Research done in good faith is welcome. Keep it to what’s yours or what we’ve given you, leave other people’s data alone, don’t degrade the service, and give us time to fix before you publish. We won’t take action against research that keeps to that.

If something goes wrong

If an incident affects you, we tell you what happened, what it reached and what we did about it, without waiting to be asked. If this policy changes, we’ll update the date at the top.