Catalog
Every claim, and what it doesn’t cover.
2 claims can be evaluated today. Each one lists its limitations, because a claim that hides its boundaries is worth nothing — and the catalog loader refuses to publish one that states none.
Privacy in code
privacy-code
Sensitive values are never logged or written to a database
No value wrapped in Sensitive<T> reaches a logging macro or a database write.
- Evidence
- source_tree
- Subject
- source_tree
What it does not cover (6)
- Only Rust source can be analyzed today. This claim is about the whole subject, not about its Rust parts, so a subject containing source in any other language is reported not_evaluable rather than passing on the strength of the half that was read. The outcome names the languages that were missed.
- Macros are not expanded, so a value that reaches a log through a macro body is not seen.
- Taint is tracked within one function body. A sensitive value handed to a helper in another function is not followed, and taint does not pass through format! into whatever consumes the resulting String.
- Logging and database calls are recognised by name. A function called `execute` is assumed to write to a database, and a sink with an unfamiliar name is not recognised at all.
- Describes source at a commit, not the binary you run. Closing that gap is what the planned build-provenance pack is for.
- Files excluded by the published skip rules are not examined. Every exclusion is reported in the outcome's coverage, with the rule that caused it.
Outbound request bodies are sanitized before they are sent
No HTTP request body is built from data that has not passed through an anonymize, redact or sanitize function.
- Evidence
- source_tree
- Subject
- source_tree
What it does not cover (7)
- Only Rust source can be analyzed today. A subject containing source in any other language is reported not_evaluable rather than passing on the strength of the part that was read.
- Macros are not expanded.
- A sanitizer is recognised by name, and taken at its word. This claim says a function called `redact` was called on the way out; it does not and cannot say that the function redacts anything.
- Request builders are recognised by method name — body, json, form and similar — so a client library with different names is not covered.
- Reading a response is distinguished from sending a request by whether the call was given an argument. A zero-argument call is treated as reading.
- Describes source at a commit, not the binary you run.
- Files excluded by the published skip rules are not examined. Every exclusion is reported in the outcome's coverage, with the rule that caused it.
Not yet available
These are described in the standard and are not built. They are listed so you can see what is coming and, more usefully, what isnot being claimed today.
- count-integrity — nine claims about pay-to-vote contests, specified and frozen in the standard. The transparency log, receipts and the browser verifier work today; the evaluators are being written now.
- integration-code — every code path that writes a vote also reports it.
- build-provenance — the deployed binary was built from the attested commit.
- outside-in — third-party trackers, cookies, TLS and headers, from probes Attestr runs.
- data-retention — deleted accounts are actually purged.