AI Gateway

AI Gateway Security & Software Transparency

Enterprise AI demands uncompromising trust at every layer of the stack.

Production-grade AI cannot rely on blind trust. Radicalbit secures the AI Gateway supply chain across both Open Source and Enterprise versions through automated pipeline governance, daily vulnerability intelligence, and machine-verifiable artifacts, giving complete transparency at scale.

download security reports

Security By Design

We eliminate black-box risk from your AI stack.

Every deployment artifact comes with verifiable cryptographic signatures, a machine-readable bill of materials, and automated daily vulnerability tracking.

What we do

What It Gives You

Mandatory peer code review

No code reaches production without peer approval and passing automated quality gatekeeping.

Digitally signed container images

Cryptographic proof that your software originates directly from Radicalbit and remains untampered.

Automated SBOM generation

Total visibility into what is inside the product, with a complete inventory of every library, package, and dependency.

Continuous vulnerability re-checking

Fast detection of newly discovered CVEs across both active and legacy releases through daily automated checks.

Dedicated Security Triage & Remediation

Rapid prioritization and handling of open vulnerabilities by our security engineers based on real-world exploitability.

Code Review

Security starts at the commit level. We enforce the same strict review policy across both Open Source and Enterprise repositories.

Pull Requests Only: Direct commits to the main branch are strictly blocked. Every modification must be submitted via a pull request.
Dual-Control Approval: Each PR requires explicit approval from at least one Radicalbit core developer other than the author before merging.
Automated Guardrails: Automated CI pipelines execute unit and regression tests, enforce style guidelines, and run scanners to prevent committed secrets or API credentials.
Automated Dependency Updates: Security patches and library updates are proposed via automated PRs and subjected to the same review process.

Image Signatures: Proof of Origin & Integrity

Container security cannot rely on blind trust. Every AI Gateway container image is cryptographically signed at build time using Sigstore, the open industry standard for artifact signing.

Authentic Origin: Verifies that the container was built by Radicalbit’s automated CI/CD pipeline and not an untrusted third party.
Tamper-Evident: Any modification to the container layer, no matter how small, invalidates the digital signature.
Keyless Security: Signatures leverage short-lived OIDC tokens tied strictly to the build runtime, eliminating static private keys that could be leaked or compromised.
Public Auditability: Signatures are logged into a public, tamper-resistant transparency log (Rekor).

Verification in seconds: You can manually verify image or configure deployment engines to reject any unsigned image automatically.

Supply Chain Transparency: Complete Component Visibility

For every build, our pipeline produces a Software Bill of Materials (SBOM) compliant with the CycloneDX standard. This provides an exact, granular inventory of every component running in your infrastructure.

The SBOM covers the entire runtime environment:

Base OS packages included within the container layers.
Application dependencies and third-party libraries.
Web UI components and associated frontend assets.

Our SBOMs are generated directly from the final deployment artifacts, so they reflect the exact binaries running in production.

Proactive Vulnerability Lifecycle Management

Software supply chain risks do not stop at release. Our monitoring pipeline continues tracking components throughout their operational lifecycle.

24-Hour Automated Re-checks: Every cataloged component is matched against public vulnerability databases at least once every 24 hours to catch newly disclosed zero-days and CVEs in existing versions.
Daily Security Engineering Reviews: Our security team receives a daily dashboard prioritizing open vulnerabilities by CVSS severity and real-world exploitability.
Contextual Impact Analysis: Vulnerabilities are evaluated for contextual exploitability within the AI Gateway runtime. False positives are documented, while valid risks are tracked through resolution or mitigation.

Enterprise Compliance & Security Reports

Security and compliance artifacts are available in standardized, machine-readable formats, designed to integrate seamlessly into your enterprise security pipelines, vulnerability management tools, and compliance workflows.

Report

Scope & Value

Software Bill of Materials (SBOM)

A comprehensive inventory of all direct and third-party components included across the release stack.

Vulnerability Disclosure Report (VDR)

A detailed catalog of all disclosed vulnerabilities identified across the software’s components and dependencies.

Vulnerability Exploitability eXchange (VEX)

Actionable engineering analysis detailing actual impact, remediation roadmaps, or mitigations.

Need our security and transparency reports?

Fill out the form below to receive our technical reports.

Secure, integrate and scale your AI traffic with Open-source Governance

Book a Demo