Skip to main content
ClawQL
SecurityVerifiable

Security status

This page proves ClawQL's security process runs and holds. Every element is either raw, independently verifiable data (an SBOM, a signature command, a CI log) or a real history of scan outcomes — including failures that were caught and fixed — never a badge claiming a snapshot state. Spec: security-status-page-spec.md.

This is not a live vulnerability dashboard. It never lists currently open, unpatched findings on unmerged branches — only historical gate outcomes after CI has already recorded them.

← Security overview

Latest release

Version
v8.0.0
Published
2026-10-17
Commit
23fc114d
SBOM (Syft)
Download SBOM — cyclonedx-json (CI artifact sbom-cyclonedx-repository)
Verify signature
cosign verify ghcr.io/danielsmithdevelopment/clawql-mcp@sha256:<digest> \
  --certificate-identity-regexp 'https://github\.com/danielsmithdevelopment/ClawQL/.*' \
  --certificate-oidc-issuer-regexp 'https://token\.actions\.githubusercontent\.com.*'

Digest fills in when a signed image record is published from the container release pipeline. Until then, substitute the sha256:<digest> from the GHCR package page.

Scan history

Last 30 published main-branch CI supply-chain runs (capped at 30). Failed rows are never removed — a fail-then-fix pair is evidence the gate blocked a merge. Sourced from CI export artifacts, not hand-curated.

RunDateCommitTrivyOSVResultCI log
#389890038782026-10-1723fc114dpasspassmergedlink
#389803226952026-10-16c4424995passpassmergedlink
#389702069622026-10-16550ed082passpassmergedlink
#389376293432026-10-16f06c1080passpassmergedlink
#388353962962026-10-168c82a405passpassmergedlink
#388032589452026-10-152afc40a3passFAILblockedlink
#386108788102026-10-148b3fee1cpasspassmergedlink
#383672816462026-10-135a6d0b37passpassmergedlink
#383535284522026-10-13393d594epasspassmergedlink
#383420200082026-10-134dfffce4passpassmergedlink
#383081579382026-10-12d0980268passpassmergedlink
#383038106322026-10-12a0e125f1passpassmergedlink
#382973201482026-10-120c1df079passpassmergedlink
#382902747172026-10-1222c6e8b4passpassmergedlink
#382865909942026-10-1284e30d21passpassmergedlink
#382071419062026-10-125b3f40a0passpassmergedlink
#381992587342026-10-12ae7f166dpasspassmergedlink
#381720218472026-10-1130416368passpassmergedlink
#381569824532026-10-117c8a7ad7passpassmergedlink
#381450051962026-10-11d2914e96passpassmergedlink
#381409532422026-10-1167427ac4passpassmergedlink
#381174759562026-10-116f2574c5passpassmergedlink
#381163957462026-10-11ace0d518passpassmergedlink
#381076381002026-10-113e5f607cpasspassmergedlink
#381047353902026-10-118be57cc8passpassmergedlink
#381031113202026-10-1169ab976cpasspassmergedlink
#381015152562026-10-1127b7cce2passpassmergedlink
#380998756662026-10-11186b2ca3passpassmergedlink
#380982416602026-10-110e767732passpassmergedlink
#380948552962026-10-10909efc87passpassmergedlink

History updated: 2026-10-17T04:18:47.453Z

Security policy

Disclosure process and response-time commitments live in SECURITY.md. Report vulnerabilities to daniel@clawql.com— do not open public issues for undisclosed findings.

SeverityTarget first response
Critical48 hours
High5 business days
Other10 business days

Independent verification

Third-party, vendor-neutral security benchmarks (for example MCPSEC-style formal properties) will be linked here when ClawQL completes a reproducible external evaluation — same independent-evidence principle as Harvey LAB and ExtractBench. This page does not make comparative "most secure gateway" claims.