Security & Vulnerability Disclosure

1. Current Website Security Architecture

Govind Cloud prioritizes transparency regarding our current operational security posture:

• Static Architecture: This website is exported as purely static assets hosted on Google Cloud (Firebase Hosting) with zero server-side application logic or database execution, dramatically minimizing the attack surface.
• Strict HTTPS & Transport Security: All connections are forced over TLS 1.3 with modern cipher suites and Strict-Transport-Security (HSTS) headers.
• Zero Credential Storage: This website does not request, accept, or store any user cloud credentials, IAM roles, AWS secret keys, or customer infrastructure state files.

2. Platform Security Architecture

As Govind Cloud progresses through early access evaluation, our control plane architecture is engineered around the following core security principles:

• Zero-Trust IAM: Short-lived AWS IAM OIDC roles and Azure Federated Credentials eliminating permanent static API keys.
• State Encryption: Dedicated KMS customer-managed keys (CMK) with AES-256 state file vaulting.
• Policy Guardrails: Pre-commit OPA Rego evaluation scanning against CIS Benchmark standards prior to any execution.

Detailed platform security whitepapers and compliance audit certifications will be published prior to general availability.

3. Responsible Vulnerability Disclosure

We welcome security researchers and community members to inspect our site and report potential vulnerabilities responsibly. If you discover a vulnerability, please let us know immediately so we can address it.