Security posture, stated plainly.
What the product does with your directory, what it never does, how releases are signed, and how to report a vulnerability. Items marked as placeholders are unpublished, not unknown to the company.
Reads
Active Directory attributes: servicePrincipalName, msDS-SupportedEncryptionTypes, msDS-AllowedToDelegateTo, msDS-AllowedToActOnBehalfOfOtherIdentity, TrustedForDelegation, pwdLastSet, msDS-KeyVersionNumber where readable. Local service configuration on hosts you point it at.
Writes
servicePrincipalName on one account at a time, six providers only, ShouldProcess-gated. Files you ask it to export: plans, hand-off bundles, runbooks, reports.
Never
Keytabs, passwords, or any secret. It does not send telemetry: {{ tok.TELEMETRY_POLICY }}. It does not call home for licensing except: {{ tok.LICENSE_CHECK_BEHAVIOUR }}.
- release signing
- Module and evidence packs are signed. Key fingerprint:
{{ tok.SIGNING_KEY_FINGERPRINT }} - verify
- Steps:
{{ tok.VERIFY_STEPS }} - SBOM
{{ tok.SBOM_URL }}- dependencies
- Third-party components and licences are listed on the license page →.
- tests
- 1,662 PowerShell, 554 C#, passing
- coverage
- 94.9% command coverage
- mutation testing
- On top of coverage: would the test fail if the code changed
- live proof
- Ephemeral forests in AWS and Azure; signed evidence packs. Proof and evidence →
Report vulnerabilities to {{ tok.SECURITY_EMAIL }}. Acknowledgement target, remediation target, and safe-harbour statement are on the vulnerability disclosure page →.
- legal entity
- Detent Point LLC
- jurisdiction
{{ tok.JURISDICTION }}- data handling
- Data handling and sub-processors →
- privacy
- Privacy policy →