March 2026 Security Audit Results

Audit Scope

The audit covered the full platform stack: API gateway, agent sandbox runtime, logging pipeline, and the builder console. Testing was conducted by NCC Group over four weeks.

Findings

Severity	Count	Status
Critical	0	—
High	0	—
Medium	2	Patched
Low	5	Accepted risk

Medium Findings

Sandbox escape via symlink — Patched by hardening mount namespace.

Log replay without nonce — Added nonce field to all signed log entries.

Full report available under NDA. Contact security@clawagent.hub.