Security

The static pipeline disassembles; it never executes. Analysis runs behind a sandbox boundary and only a schema-validated result crosses back — the output wall. Samples are read only from local paths you provide; remote and UNC sources are refused before any analysis.

Running a binary is opt-in twice over: a server flag (GROUNDRE_ENABLE_DYNAMIC) plus explicit per-run consent. It is time-boxed, runs in a throwaway working directory, and fails closed when isolation isn’t available — it never silently downgrades to an unisolated run.

• Authenticode/signature verification is part of triage — we tell you who signed a binary before you trust its behavior.
• SOC 2 Type II and ISO 27001 aligned controls; audit logging on verdicts and jobs.
• Report a vulnerability: security@groundre.dev (PGP available).