Trust · Security
Security posture
OpenLegal treats legal documents and operator credentials as sensitive by default. The posture is: local-first data, fail-closed crossing, hash-only logs, no secrets in tooling, and honest exposure handling.
Core posture
Local-first by default
Case data lives in the operator’s own repository. The engine does not upload, phone home, or bootstrap from network requests.
Fail-closed boundaries
Any crossing — model routing, data egress — is denied unless explicitly verified and approved.
No raw content in logs
Invocation audit records hashes, not prompts or responses. Logs stay greppable for questions like “who was invoked” without containing the case material.
Secrets stay out of the repo
Credentials are never committed to the repository or published. Diagnostic and health tooling reports presence/absence only — never values — and is public-data-safe by construction.
What the site itself guarantees
| Commitment | How it is enforced |
|---|---|
| No case data | This site is static and contains no matter files, excerpts, entities, or facts — verified by automated public-data audit before each release of the site. |
| No credentials or configuration | No keys, tokens, .env values, or private runtime state exist in the site’s sources or build output. |
| No private paths | No operator filesystem paths, ledger internals, or audit records are referenced. |
| No fake functionality | The site documents the real product and gives real commands — it does not pretend to run an interactive legal system. |
| Safe by default | External links use HTTPS; the build sets no-sniff and referrer policies. |
If something is ever exposed
Exposure handling is a process, not a magic feature. If a private value or case artifact is ever found on this site or in the repository: the exposure is treated as a defect, it is removed and gitignored where relevant, and the relevant boundaries are re-audited. Reports and corrections are documented in the project’s internal history — this page describes the standing posture, not a specific past incident.