SpendGuard / AgentProof architecture
ACHIEVED ·
Issuer: KushBitx
Type: Technical trust signal
Public documentation; not an independent architecture audit.
Reviewed 27 September 2026
Trust Center
Security evidence and assurance status for KushBitx SpendGuard / AgentProof. Every entry states its scope and limitations. An application, pledge, self-assessment or scan is not a certification.
Dates describe the recorded observation, not continuous assurance. An issuer/program link alone does not prove that KushBitx has been accepted. Historical external grades may change on a later scan.
Architecture
Non-custodial boundary
SpendGuard non-custodial boundary
ACHIEVED ·
Issuer: KushBitx
Type: Technical trust signal
No wallet private keys, seed phrases, transaction signing or customer payment execution. A separate trusted signer/payment system must enforce decisions.
Security
Security reporting and triage policy
ACHIEVED ·
Issuer: KushBitx
Type: Technical trust signal
Published intake and triage procedure; no penetration-test or response-time certification.
Vulnerability disclosure
RFC 9116 security.txt + VDP
ACHIEVED ·
Issuer: KushBitx / RFC 9116
Type: Technical trust signal
Public reporting metadata and policy; not a bug-bounty or third-party certification.
CVE Numbering Authority onboarding
SUBMITTED ·
Issuer: CVE Program
Type: Registry listing
Application CAN-2026-2038438 submitted on 27 September 2026; official web confirmation retained as evidence KBX-E-20260927-038. Requested scope covers KushBitx-maintained software and services, including SpendGuard / AgentProof and @kushbitx/sdk, excluding third-party products and customer signing/payment systems. KushBitx is not a CNA. Acceptance and domain verification remain outstanding; this program link is not a public acceptance record.
Privacy
KushBitx Privacy notice
ACHIEVED ·
Issuer: KushBitx
Type: Technical trust signal
Self-published data-handling notice; not an independent privacy certification.
Open-source assurance
OpenChain ISO/IEC 18974
GAP CLOSURE ·
Issuer: OpenChain Project
Type: Self-certification / self-conformance
No conformance claim. Competency, monitoring and complete official checklist evidence remain incomplete.
OpenChain ISO/IEC 5230
GAP CLOSURE ·
Issuer: OpenChain Project
Type: Self-certification / self-conformance
No conformance claim. Legal expertise, competency and full release-obligation records remain incomplete.
OpenSSF Best Practices Badge
BLOCKED ·
Issuer: OpenSSF
Type: Public self-assessment
No badge claimed. Public source repository and complete criterion evidence required.
OSPS Baseline Level 1
IN PREPARATION ·
Issuer: OpenSSF
Type: Public self-assessment
No compliance or badge claim; controls must be mapped to evidence.
OpenSSF Scorecard
BLOCKED ·
Issuer: OpenSSF
Type: Automated external security rating
No current published repository score. Alternate-host compatibility must be validated.
REUSE Compliance
NOT STARTED ·
Issuer: Free Software Foundation Europe
Type: Technical trust signal
Repository licensing metadata and tool validation have not been completed.
AI governance
AI governance evidence review
IN PREPARATION ·
Issuer: KushBitx
Type: Public self-assessment
Policies and operational controls still need evidence mapping; no model audit or AI-system certification.
Supply-chain security
npm Trusted Publishing / Provenance
IN PREPARATION ·
Issuer: npm
Type: Technical trust signal
No provenance claim for existing @kushbitx/sdk release; supported CI/OIDC publisher identity is not yet established.
Sigstore / Cosign keyless signing
IN PREPARATION ·
Issuer: Sigstore
Type: Technical trust signal
No signed-release claim. Identity-bound release signing and verification evidence remain outstanding.
External security ratings
Mozilla HTTP Observatory A+
ACHIEVED ·
Issuer: Mozilla
Type: Automated external security rating
Historical result recorded 26 September 2026: 115/100, 12 passed, 0 failed. HTTP configuration only; not a certification or guarantee of application security.
Qualys SSL Labs A+
ACHIEVED ·
Issuer: Qualys SSL Labs
Type: Automated external security rating
Historical result recorded 26 September 2026. TLS configuration only; link may show a later result. Not a certification.
Internet.nl Website 100% Badge
GAP CLOSURE ·
Issuer: Internet.nl
Type: Automated external security rating
Recorded baseline 61%; 100% badge not achieved. DNSSEC, IPv6 and TLS findings remain.
Internet.nl Email 100% Badge
GAP CLOSURE ·
Issuer: Internet.nl
Type: Automated external security rating
Recorded baseline 77%; 100% badge not achieved. Mail authentication/transport and DNS evidence remain.
SecurityScorecard Free Scorecard
IN PREPARATION ·
Issuer: SecurityScorecard
Type: Automated external security rating
Activation invitation received. Domain claim and footprint validation incomplete; no score claimed.
Public pledges
CSA AI Trustworthy Pledge
SUBMITTED ·
Issuer: Cloud Security Alliance
Type: Public pledge
Official form submitted; public listing or badge acceptance not independently confirmed. Program link is not proof of acceptance.
CISA Secure by Design Pledge
IN PREPARATION ·
Issuer: CISA
Type: Public pledge
Onboarding request sent; pledge signing and acceptance not confirmed. Not a certification.
EU AI Pact — Pillar II
IN PREPARATION ·
Issuer: European Commission
Type: Public pledge
Participation inquiry sent; declaration and public acceptance not confirmed.
Cybersecurity Tech Accord
IN PREPARATION ·
Issuer: Cybersecurity Tech Accord
Type: Public pledge
Eligibility and fee inquiry sent. KushBitx does not claim signatory status.
Cybersecurity Awareness Month 2026 Champion
ACHIEVED ·
Issuer: National Cybersecurity Alliance
Type: Public pledge
Official 2026 Champion participation confirmed by National Cybersecurity Alliance email on 27 September 2026; issuer confirmation retained as evidence KBX-E-20260927-040. This is cybersecurity awareness participation, not a security certification, accreditation, audit or CISA certification. The issuer email is private; an independent public participant listing has not been verified. No badge image is displayed while asset retrieval remains incomplete.
Self-assessments
CSA STAR Level 1 — CAIQ v4.1
GAP CLOSURE ·
Issuer: Cloud Security Alliance
Type: Public self-assessment
Setup requested; official completed CAIQ has not been submitted. No registry listing or independent audit claimed.
CSA STAR for AI Level 1 — AI-CAIQ v1.1
GAP CLOSURE ·
Issuer: Cloud Security Alliance
Type: Public self-assessment
Setup requested; official completed AI-CAIQ has not been submitted. No paid validation or badge claimed.
Certifications
Third-party / accredited certifications
NOT STARTED ·
Issuer: Not applicable
Type: Third-party certification / Accredited certification
No third-party or accredited certification is claimed on this Trust Center.
No certificate evidence available.
Registry listings
Public npm package @kushbitx/sdk
ACHIEVED ·
Issuer: npm
Type: Registry listing
Public software distribution; npm presence is not endorsement, identity verification or security certification.
Agenstry package index
ACHIEVED ·
Issuer: Agenstry
Type: Registry listing
@kushbitx/sdk indexing was confirmed during submission. Listing permalink and owner verification are still being reconciled; index presence is not an audit.
Official MCP Registry
NOT STARTED ·
Issuer: Model Context Protocol
Type: Registry listing
Official KushBitx MCP package readiness and namespace verification required. No listing claimed.
D-U-N-S Number
BLOCKED ·
Issuer: Dun & Bradstreet
Type: Registry listing
Exact legal entity and registration evidence required. No number claimed.
Verification badges
Agenstry Verified Owner
IN PREPARATION ·
Issuer: Agenstry
Type: Verified owner / publisher badge
Domain verification pending. Indexing and ownership verification are separate.
M8ven Full Verified Publisher
BLOCKED ·
Issuer: M8ven
Type: Verified owner / publisher badge
README proof pending GitHub restoration; full badge not claimed.
GitHub organization/domain verification
BLOCKED ·
Issuer: GitHub
Type: Verified owner / publisher badge
Account/repositories currently unavailable; verified-domain badge not claimed.
Current gaps
CISA Cyber Hygiene enrollment
BLOCKED ·
Issuer: CISA
Type: Technical trust signal
International eligibility inquiry sent. Enrollment requires CISA approval; no participation or certification claim.