Security
Checking a result never depends on us.
The design fails closed, and verification rests on hashes, signatures and an append-only log, not on trust in the vendor.
01
Status, stated plainly
| Item | Status | Detail |
|---|---|---|
| Hosted service | None | The engine runs on your machine. There is no Glovrex server for it to report to. |
| Telemetry in the engine | None | Nothing is sent to us by default or by option. |
| Hosted verification | None | Receipts verify offline. Our answer is never the only way to check a result. |
| Certification | None yet | No SOC 2 or ISO 27001 certification yet. |
| Response time | Not guaranteed | No guaranteed response time yet; reports are read by the founder. |
02
Threat model, in short
- Fail-closed
- When the inverse cannot be built or a check cannot run, the change does not land. Unknown is reported as unknown, never folded into pass.
- Independent verification
- Receipts are signed and anchored in an append-only log. A third party re-verifies them offline with the standalone verifier, without the issuer and without a server.
- Out of scope by design
- Writes with root or kernel privilege bypass the engine at the operating-system level; writes into the engine's own state cannot be judged from inside it; a policy that encodes the wrong intent is enforced faithfully.
03
Data handling
The engine keeps its ledger, receipts and keys on your machine and sends nothing to us.
| Processor | For | Region |
|---|---|---|
| Vercel Inc. | Hosting this website, request logs, cookieless page counts | United States, global edge network |
| Zoho (zoho.jp) | The mailbox that receives reports | Japan data centre |
The website collects only what the privacy policy lists. Checked on 6 October 2026.
04
Reporting a vulnerability
- Where
- Email mahirohirakawa@glovrex.com with a description, the affected version or commit, and steps to reproduce. Please do not open a public issue for an unfixed vulnerability.
- Scope
- The engine's public source, its published packages, and glovrex.com. Out of scope: load tests, social engineering, and third-party services we use.
- Safe harbour
- Research done in good faith, within this scope, without touching other people's data and without degrading the service, will not be pursued by us. If in doubt, ask first.
- Response
- We acknowledge a report when we read it and say what we will do. There is no guaranteed response time yet, and no paid bounty; credit is given if you wish.