A security tool that can secure itself
The question under every question: can you trust the tool that judges your estate? Here is how Kameen answers it — in architecture, not promises. Every line below is enforced by the product's own build gates and tests.
Read-only by architecture
Assessment probes never write. Not "are configured not to" — CANNOT: an automated build check fails if any code path can write changes to an assessed host. Remediation is prescribed as packages your team applies; the platform's role ends at verification. The distinction is structural, and it is tested on every build.
Signed, everywhere it matters
Content bundles, intelligence packs, product updates and licenses all arrive Ed25519-signed, verified before anything mounts — a bundle that fails verification applies nothing, and a failed restore leaves the appliance down rather than booting an unverifiable state. Licenses bind to your deployment identity; revocation is a signed document, and expiry never locks safety operations.
No AI in the evidence path
Findings, verdicts, ranks and attestations are deterministic: the same sealed inputs produce the same outputs, byte for byte, offline. There is no model interpreting your evidence, no generated prose in a report you sign, no probabilistic step between the probe and the verdict. When AI appears anywhere near the product, it will pass a canary gate first and be clearly labeled as non-evidence — until then, nothing.
Secrets are never stored — not even echoed
When the artifact and code scanners meet a secret, the finding records the file, the line and the CATEGORY of what matched. The value itself is never written to disk, never enters evidence, never appears in a report — and even the optional context preview passes through the redaction corpus first. The rule is called ECHO-NEVER, and it is structural.
The fence you can watch
The platform's egress fence refuses connections to anything outside the approved scope — including private, loopback and link-local addresses on notification and integration paths, with redirect targets re-validated. The console renders the live proof: a persistent OUTBOUND counter that reads 0. Trust features that hide are marketing; this one sits on every screen.
An append-only conscience
Every privileged action, gate decision, license import and verification outcome lands in an append-only audit journal, exportable and signed. Refusals are audited with their reasons — including the honest ones: "this campaign was denied because the license does not carry that module." An operator can always answer "who did what, when, and why it was allowed or refused."