Security Assurance

Executive Summary

Cerebion Rivet is a desktop application that runs entirely on your infrastructure. Your source code, binaries, certificates, and scan results never leave your machine. Cerebion LLC does not operate a cloud scanning service and does not receive, process, or store any of your intellectual property.

1. Architecture Overview

Your Machine (air-gappable)
┌──────────────────────────────────────────────┐
│  Cerebion Rivet UI  (Electron + React)        │
│  Cerebion Rivet Engine  (FastAPI + Python)    │
│  Scan history  (local SQLite only)            │
│  Your codebase / binaries / certificates      │
└──────────────────────────────────────────────┘
         │  HTTPS - license validation only
         ▼
  Cerebion License Server
  (account data only - no scan data)

• Runs as a standard desktop application - no kernel drivers, no system services
• Does not require administrator/root privileges to install or run
• Does not intercept or monitor network traffic
• Does not modify your source code unless you explicitly apply an AI-generated fix
• AI features are optional and user-initiated - disabled by default until you provide your own API key
• 7-day offline license cache - air-gap deployments supported

2. Data Handling

What Stays on Your Machine (Always)

What Is Transmitted (License Validation Only)

Offline operation: Cerebion Rivet caches a valid license for 7 days. You can operate fully offline within that window with no connectivity to Cerebion servers.

AI Features (Optional - User Controlled)

All AI-powered features are entirely optional and off by default. No AI provider is contacted unless you configure an API key and explicitly trigger an AI action.

There are two AI data flows:

1. AI Fix Generation - When you request a code fix for a finding, the relevant code snippet is sent to your chosen AI provider.

2. AI Report Generation - When you select scan findings and request an AI-generated report, those findings (algorithm names, severity levels, file paths) are sent to your chosen AI provider.

In both cases:

• Your API key is stored locally in Electron's encrypted credential store - never transmitted to Cerebion
• Data is sent directly from your machine to your chosen provider; Cerebion never sees it
• Only the content you explicitly select is included - no full file contents or project-wide data

To use Cerebion Rivet with zero external AI calls: use a local provider or simply do not configure the AI feature. All rule-based scanning works fully without it.

3. Security Controls

3.1 Code Signing and Integrity

3.2 Software Bill of Materials (SBOM)

A Software Bill of Materials in CycloneDX format is available for every release, listing all bundled dependencies with version numbers and licenses. Available on request: support@cerebion.com

Current version: 1.1.73 | Windows SBOM available now; Linux and macOS on request.

3.3 Dependency Vulnerability Management

All dependencies are audited before every release using pip-audit (Python) and npm audit (Node.js).

v1.1.73 audit results: Python: 0 known vulnerabilities in shipped code. Node.js: 0 vulnerabilities.

3.4 No Telemetry

Cerebion Rivet does not collect usage analytics, crash reports, feature usage statistics, or keystroke/clipboard data.

3.5 Local Storage Only

All scan data is stored in a local SQLite database:

• Windows: %APPDATA%\CerebionRivet\
• macOS: ~/Library/Application Support/CerebionRivet/
• Linux: ~/.config/CerebionRivet/

You own this data. Uninstalling the application removes it.

4. Permissions and System Access

Cerebion Rivet does not access: registry (beyond standard Electron entries), other processes, network traffic or packet capture, credential stores, files outside the folder you open, or camera/microphone/peripherals.

5. Infrastructure Security (License Server)

6. Cryptographic Standards

7. Vulnerability Disclosure

• Email: support@cerebion.com
• Response time: We acknowledge within 24 hours and provide a fix timeline within 48 hours
• Recognition: Security researchers are acknowledged in release notes (with permission)
• No legal action: We do not pursue legal action against good-faith security researchers

8. Compliance Posture

9. Enterprise Deployment Guidance

Network Requirements

Recommended Security Controls

• Allowlist outbound connections to license.cerebion.com:443 only (if AI feature not used)
• Deploy from official installer downloaded from cerebion.com - verify code signature before rollout
• Verify SBOM against your approved dependency list before enterprise deployment
• Disable AI fix feature in policy-restricted environments by not deploying AI API keys

Cerebion Rivet installs as a standard per-user or per-machine application and can be deployed via SCCM, Intune, Jamf, or Ansible. No special privileges required at runtime.

10. Contact

For security questions, vulnerability reports, SBOM requests, or enterprise deployment support: support@cerebion.com

Cerebion LLC  |  Sterling Heights, Michigan  |  cerebion.com
This document is provided for informational purposes only and does not constitute a warranty, guarantee, or contractual commitment. See your Cerebion License Agreement for binding terms.