Security that starts with its own limits
Reinstator sends adversarial traffic to your AI systems and keeps what comes back. Here is how every run is bounded, how your evidence is protected, who can read it, how the verifier itself is tested, and what is not built yet.
Product status
Reinstator is available by waitlist, for AI systems you own or are authorized to test. See what is built, what has been validated and what has not.
| Area | Status | Notes |
|---|---|---|
| Access | By waitlist | Reinstator is available by waitlist. Join the waitlist to register your interest. |
| Runner, evidence store, review console and API | Built and tested | Exercised end to end against synthetic test agents. |
| Customer agents | Not yet tested | Reinstator has not yet been run against a customer agent, so no efficacy figures are published. |
| Identity | Access tokens | Three roles per tenant: viewer, operator and reviewer. No single sign-on. |
| Judge models | Uncalibrated | No judge model has been calibrated against human labels. An unparseable verdict is inconclusive, never a finding. |
| Taxonomy mapping | Not mapped | Findings are not mapped to external taxonomies. They are organized by the boundary that failed. |
| Certifications | None claimed | No security certification or third-party attestation is claimed. |
This table is the reference for every status statement on this site. Last reviewed 2026-09-23.
Contain every run and protect every record
Your transcripts and findings are sensitive, and a tool that can reach your systems needs limits of its own. Each point below describes the product as it is built today.
-
Evidence encryption
Plans, transcripts, findings and reviews are encrypted with Fernet (AES-128-CBC with HMAC-SHA256) in a transactional SQLite database. Each envelope binds tenant, job, record kind and id, so a row copied to another tenant or job is rejected when it is read. IDs, record kinds, idempotency keys, status, timestamps and quota metadata stay in plaintext.
Envelope
tenantjobkindid -
Key handling
The evidence key is read from an environment reference and is never stored with the evidence. Offline tools verify encrypted backups, rotate the key in one transaction with rollback on any error, and apply retention as a dry run until you confirm. They run only while the service is stopped. There is no KMS integration yet.
Commands
live backuplive rotate-keylive retain -
Access and roles
Each access token (at least 32 characters) maps to one tenant and one role, and the tenant comes only from the token. Viewers read jobs, findings and reports. Operators can also run installed plans, cancel runs and request retests. Reviewers can also record review decisions and read raw transcripts and the audit history.
Roles
vieweroperatorreviewer -
Audit trail
Submissions, cancellation requests, recovery, retests, reviews and transcript reads are recorded, and each review is written in the same transaction as its audit record. The audit trail lives in the evidence database; it is not a separate write-once log.
Events
submittedcancel_requestedrecoveryretest_submittedreviewtrace_read -
Installed plans only
Only plans an administrator installs in the service configuration can run. API callers submit an installed plan's name and cannot supply endpoints or code, and a plan whose authorization has expired is refused.
Request
POST /v1/jobs{"plan": "<name>"} -
Network scope
One exact endpoint per role. DNS is pinned, TLS is verified and private networks need an explicit CIDR. Plain HTTP is allowed only to loopback, redirects are refused, no proxy is used, and request size, response size and time are capped.
Plan keys
allowed_cidrsallow_http_loopbackmax_response_bytes -
Spend ledger
One ledger covers target, attacker, judge, replay and observer calls, and reserves each call's declared ceiling before dispatch. Figures are reserved upper bounds, not measured billing.
Limits
max_requestsmax_usdmax_seconds -
Console and API
The console and API check the Host and Origin headers on every request, and every API call needs an access token. Responses carry a strict Content Security Policy, and the console inserts untrusted content as text, never as markup.
Checks
HostOriginAuthorization -
Tool execution
Reinstator never executes your agent's tools, and it rejects unexecuted tool calls returned by model endpoints. Evidence of a tool effect comes from your gateway or a separate backend observer.
Rejected
tool_calls -
Failure behavior
After a crash, unfinished runs are marked interrupted and never re-run automatically. Cancellation stops further calls and closes the connection of a call in flight; it cannot undo work a target has already accepted.
Status
interruptedcancelled
A verifier tested to fail closed
You should not have to take a verdict on trust. A synthetic harness runs the observed agent pack against seven versions of the same support agent: a secure baseline and six that each break one assumption. Each version must produce its expected verdict.
| Mode | What it simulates | Result | Gate |
|---|---|---|---|
| secureb73140287a58 · 69 calls | Agent enforces every boundary | Heldrejected × 10 | exit 0 · PassAll gate rules passed |
| vulnerableadc6c336705d · 137 calls | Agent violates every boundary | Reproducedconfirmed × 10 | exit 2 · Insufficient evidence10 findings await review |
| lying175483163721 · 69 calls | Agent claims actions that never reach the backend | Heldrejected × 10 | exit 0 · PassAll gate rules passed |
| dirtyaf97325b2b50 · 11 calls | Backend does not reset to the pinned snapshot | Inconclusiveinconclusive × 10 | exit 2 · Insufficient evidenceRun completed with errors |
| confounded59c8be6b6f10 · 35 calls | Violation also appears during the benign control | Inconclusiveinconclusive × 10 | exit 2 · Insufficient evidenceRun completed with errors |
| incompleteeb58f71404d5 · 31 calls | Observer telemetry is incomplete | Inconclusiveinconclusive × 10 | exit 2 · Insufficient evidenceRun completed with errors |
| nonfunctionalb072708dfc82 · 35 calls | The benign task itself fails | Inconclusiveinconclusive × 10 | exit 2 · Insufficient evidenceRun completed with errors |
In the observed agent pack, an agent that only claims it acted produces no finding. Findings come from what the backend observer records, not from what the agent says. A dirty, confounded, incomplete or non-functional system produces inconclusive results, and the strict gate returns 2.
What Reinstator does not do
Know where the product stops, so you can scope it against what it does today.
Nothing is blocked at runtime
Reinstator tests the boundaries your agent enforces. It does not sit in front of your agent or stop actions in production.
No tool execution or rollback
It does not execute your tools or roll back actions on a target.
Only the configured agent endpoint
It does not test web applications, APIs, cloud or networks beyond the configured agent endpoint.
Surfaces come from your integration
It does not find surfaces on its own. Coverage comes from the surfaces your integration declares.
Ownership is asserted, not verified
It does not verify that you own a target. Authorization is an administrator's recorded assertion of owner, scope and expiry.
A retest is not a clearance
It does not certify a fix. A retest is evidence about one proof.
Text scenarios, no bundled datasets
It does not test multimodal or multilingual behavior, and it ships no jailbreak datasets.
Smoke runs are not encrypted
Command-line smoke runs write plaintext files. Encryption applies to service runs and runs with an evidence database.
Clear rules for testing and disclosure
Authorized testing policy
Applies to every plan and every run.
Reinstator is for systems you own or are authorized to test.
What the product enforces
- Every plan must be marked authorized and name an owner, a written scope and an expiry, or it is rejected before any network access.
- Through the console and API, only plans an administrator has installed can run. API callers cannot supply endpoints or code.
- Authorization is re-checked before each call, and a run stops when its authorization expires.
- Each plan is limited to one exact endpoint per role. Plain HTTP is allowed only to loopback, and private networks need an explicitly listed range.
What we decline
We decline requests to test systems the requester does not control.
The authorization record is an administrator's assertion. Reinstator does not verify who owns a target.
Responsible disclosure
For vulnerabilities in Reinstator or this website.
If you find a vulnerability in Reinstator or this website, report it to us. There is no dedicated security email address yet, so reports come in through the waitlist form.
Open the waitlist form
Use the form at /contact/ with an email address we can reply to.
Start the note with “Security report”
Then describe the issue. Leave out credentials and personal data.
Include steps to reproduce
Say what you did, what you observed, and which page or component is affected.
Before public disclosure
Allow reasonable time for a fix.
Machine-readable: /.well-known/security.txt
What is not built yet
Each item is a gap in the product today. They are listed without dates.
- Single sign-on
- Write-once audit log outside the evidence database
- KMS integration and automated key rollout
- Mapping findings to external taxonomies
- Native CI templates, event notifications and scheduled runs
- Native adapters for agent frameworks and tool protocols
- A judge model calibrated against human labels
Building AI agents you need to trust?