Home / Trust
Trust center
How to check our work
A security tool you cannot audit is one more thing to trust blindly. Everything that makes a Lazaretto verdict believable is published here, including how often we are wrong.
Principles the code holds to
Never runs what it inspects
The fetcher only downloads and unpacks; the analyzer reads the files and their syntax trees. Nothing imports, installs or executes the artifact, and the fetcher holds no credentials worth stealing.
No model in the scan path
Verdicts come from versioned, unit-tested rules and indicator matches. The same input, under the same rules version and the same indicator data, gets the same verdict.
Malicious means a match
malicious is reserved for indicator-backed matches. Heuristic rules can only reach flagged, and always carry the file, line and snippet behind them.
Fails closed, bills nothing
An error is never downgraded to clear and never billed. A known-bad check that could not run reports null, not "no match".
Bound to bytes and signed
A verdict on scanned content names the SHA-256 of exactly what was read, and every verdict is signed with Ed25519, so it verifies offline and cannot be moved onto different code. A release the registry has pulled is named by its exact identity instead.
Reports carry no hidden instructions
Text quoted from an artifact is stripped of invisible characters, such as Unicode tag smuggling, before it reaches you. What remains is visible, framed as evidence, and meant to be read as data, never as instructions.
Published evidence
What we caught
Named incidents with the free command that reproduces each answer.
Reproduce them →Noise benchmark
How often we flag packages people install on purpose, and every attack sample we miss.
See the numbers →Sources
Every upstream feed, its licence and cadence, and what it cannot tell you.
Read the sources →Corrections log
Upheld disputes, with the cause and the fix, published as they happen.
Open the log →Rule catalog
Every rule id, category and severity at the deployed rules version.
View the catalog →Signing keys
The public keys that verify every attestation we have issued.
View the JWKS →How the fetcher is isolated
Fetching untrusted code is the dangerous part of this job, so it runs as its own service with nothing of value on it.
- A separate service. Its code opens no database connection and holds no payment or signing keys.
- HTTPS only, no credentials in URLs, and a host allowlist.
- DNS is resolved by us and the connection is pinned to the vetted address, so private, loopback, link-local and cloud-metadata addresses are refused at connect time, rebinding included.
- Every redirect is re-checked against the same rules, at most five hops.
- Artifacts are capped at 5 MB. Archives are unpacked in memory with a ceiling on decompressed size and a compression-ratio check, and nothing is written to disk or executed.
- An MCP server can live on any host, so that one target type drops the host-name list and nothing else.
What we keep
The privacy policy has the full detail.
- Scan metadata and hashed identifiers, so a verdict can be audited later.
- Never the bodies of the artifacts we fetch, and no copy of a lockfile you check.
- API keys are stored as hashes. We cannot show a key again, so save it when it is issued.
- Card payments go through Stripe's hosted checkout. Card numbers never reach us.
This website
The site is part of the product, so it is held to the same standard.
- No JavaScript at all. The Content-Security-Policy starts from
default-src 'none', so no script could run even if one were injected. - No cookies and no analytics or tracking scripts. The only third-party requests on the whole site are two status badges at the foot of the homepage, sent with no referrer.
- HTTPS only with a strict transport security policy, and no page can be framed by another site (
frame-ancestors 'none'). - Every page is also available as markdown, for agents: add
.mdto the path.
Disclosure and disputes
Found a vulnerability? Email security@lazaretto.dev. We acknowledge within three business days and do not pursue good-faith research. The policy is at /security and the contact at security.txt.
Think a verdict on something you publish is wrong? Email disputes@lazaretto.dev. A disputed malicious verdict gets a human decision within three business days, an upheld dispute invalidates the cached result at once, and it is listed in the corrections log.
Who runs it
Lazaretto is operated by Meridian Bridge Advisors LLC, a Florida limited liability company, doing business as Lazaretto. Contact contact@lazaretto.dev. Terms, privacy and the disclaimer are counsel-approved.
Lazaretto is a signals provider. A clear verdict means nothing matched our indicators or rules at scan time. It is not a statement that an artifact carries no risk, and the decision to install is yours.