// SECURITY POSTURE · VERIFIABLE

What an outside attacker sees, signed and checkable.

audioprism.pro is assessed from the outside with Bastion, a read-only security-posture scanner: headers, transport security, DNS and email authentication, exposed services, dependency risk. No exploitation, no authenticated access, roughly two hundred GET and HEAD requests. Every artifact below is hashed in a manifest and the attestation is Ed25519-signed, so you can confirm none of it was edited after the scan.

Disclosure, read this first. Bastion is built by the same person who builds AudioPrism, and this assessment was run by us, on our own site. It is not an independent audit and no third party has reviewed it. What the signature lets you verify is narrower and more honest than that: that these exact results were produced by the published key on the stated date and have not been altered since. Judge the findings, and the ones still open, for yourself.

POSTURE

STRONG

85 / 100

RELEASE GATE

PASS

policy floor met

TLS GRADE

A+

TLS 1.2 / 1.3 only

CRITICAL · HIGH

0 · 0

1 medium · 3 low

COVERAGE

28 / 28

checks ran to completion

ASSESSED

13 Sep 2026

18:08 UTC · adversarial depth

08:01 UTC · FAIR 71→ headers hardened the same afternoon →18:08 UTC · STRONG 85

What is still open, and why

A clean sheet would be a red flag on a page like this. These are the findings the last scan still reports, with our position on each.

SEVERITY	FINDING	OUR POSITION
MEDIUM	SSH exposed on port 22	Administrative access to the server. Key-based login, brute-force lockout active. Password login is being retired.
LOW	Content-Security-Policy allows `'unsafe-eval'` and inline styles	The page runtime compiles its templates at load and the design uses inline styles. Script sources are pinned to named hosts; there are no inline scripts. Accepted for now.
LOW	No CAA DNS record	Being added at the registrar to pin certificate issuance to Let's Encrypt.
LOW	HTTP service on port 8080	An unrelated test service on the same host. Being closed.
INFO	No MTA-STS policy	Mail for the domain is handled by a provider; SPF and DMARC are in place. Not planned.

Verify it yourself

The attestation carries a SHA-256 over its canonical payload and an Ed25519 signature from the key below. With a copy of Bastion, one command checks both. Without it, you can still confirm the hash printed here matches the file and that the manifest lists the same hash for every artifact.

attestation sha256   39b205fb9c4f3215f2779943ec7f8889e440ffc605c26e08e65dfac04d195702
signing key id       df85ea24ec23b3c7   (Ed25519, public key published below)

node cli.js verify-attestation audioprism-pro.attestation.json --pubkey attestation-pub.pem
# ✓ hash VALID — payload unaltered
# ✓ Ed25519 signature VALID — produced by key df85ea24ec23b3c7

Artifacts

SummaryOne page: verdict, framework readiness, module results.
Buyer-safe reportEvery verified finding, redacted of internal evidence.
Attestation (JSON)Canonical payload, hash, and signature. The file you verify.
Attestation (readable)The same attestation as a document.
ManifestSHA-256 of all 14 artifacts in the bundle, including the ones not published here.
Public keyEd25519 verification key, id df85ea24ec23b3c7.

What this does not claim

It does not test the desktop application, which runs entirely on your machine and sends nothing to us. It does not cover authenticated or internal systems, and it is not a penetration test. It is the external surface of a website, measured honestly, with the measurement itself made tamper-evident.