Security

Security is core architecture at MANUSH, not a later addition.

Platform security

Our web platform follows the OWASP Application Security Verification Standard (ASVS) as a baseline: password hashing with Argon2id, CSRF tokens, prepared statements, output escaping, secure HTTPS-only cookies, session rotation, login throttling, rate limiting, role-based access control, upload and MIME validation, file size restrictions, audit logging, security headers, a Content Security Policy, database least privilege and environment secrets. Administrators use 2FA/TOTP or passkeys (WebAuthn).

Robot security

• Identity: each robot receives a cryptographically secured identity.
• Secure update system: every robot receives authenticated OTA software updates.
• Safety kernel: high-level AI is never allowed to bypass the low-level safety system (MANUSH SafeCore™).
• Offline operation: robots continue essential operations if the internet disappears.

Responsible disclosure

Found a vulnerability? Email [email protected] with details and steps to reproduce. Please give us reasonable time to fix issues before disclosure and avoid accessing data that isn’t yours. We do not pursue good-faith research.