Security and evidence

Evidence you can verify.

The default runtime path supports signed evidence. With the exact bundle, its manifest, and a trusted public key, check the artifact integrity locally. Regional signing, retention, and sharing must be checked for the path you use.

01How it works

Hash, sign, verify.

For signed output, Tachyonic packages the evidence bundle and records the SHA-256 of the artifact bytes in a manifest. The manifest is signed with a Tachyonic-managed Ed25519 key. The public half is published at a well-known URL.

# Published verification key
https://tachyonic.sh/.well-known/signing-pubkey.json

To verify, recompute the artifact hash, check it against the manifest, and verify the signature against the published key. The CLI does all three:

tachyonic verify ./tachyonic-evidence --pubkey ./signing-pubkey.pem

Passing a local public key keeps verification offline. Without that option, the CLI fetches the published key. Keep your downloaded bundle, manifest, and trusted key; artifact availability and reviewer links have expiry limits.

02The evidence bundle

Inspect what the run produced.

Findings

Severity-rated results mapped to OWASP LLM Top 10 and MITRE ATLAS.

Payloads and captures

The attack inputs and the request and response captures they produced.

Lifecycle events

Status transitions and runtime logs captured as artifacts.

Runtime policy

The target, region, budget, and approval policy the runtime ran under.

Report output

The human-readable report generated from the run.

Signed manifest

When emitted, the SHA-256 manifest and Ed25519 signature bind the artifact bytes to the signing key.

03Security boundaries

Know what the result establishes.

A valid signature establishes the artifact bytes and the signing key. Review the target, policy, coverage, and findings to assess what the test exercised. Container sandboxes share the host kernel, so review their images and permitted access as well. Contact [email protected] to report a vulnerability in Tachyonic.

Verify your first bundle.

Inspect the available artifacts, download the signed bundle and manifest, and verify them.

Get Started Verification docs