kerfmaster.com security page — DRAFT exists, publish blocked on Aristide's checklist

kerfmaster pin list · Agreed & queued (build after fidelity)

recordStates what the code does today. Auditable against the code — this is the only type that can go stale.

Content last changed 2026-09-13 — computed from the item itself, not typed.

What exists: the full draft at docs/security-page-kerfmaster.md (commit 95e479b). Sections: your-files-stay-yours, TLS in transit, AWS hosting/physical layer, zero-dependency attack surface, daily snapshots + health-checked auto-rollback deploys + dev/prod separation, roadmap sections (operator accounts, on-premise Windows version), vulnerability reporting, contact.

Publish gate — Aristide's checklist (in the file header):

1. Create security@kerfmaster.com and info@kerfmaster.com (he is erecting the addresses)
2. Ask Sem whether prod's EBS volumes are encrypted at rest — the draft deliberately does NOT claim encryption at rest until proven; add the paragraph if yes
3. His keep-or-hold call on the two roadmap sections (operator accounts, on-premise option)
4. Payments section omitted until subscriptions exist

Then: on his word ('move the security page to the site') the styled page gets built in kerfmaster-site/ and auto-deploys to kerfmaster.com (~4 min). Related: pin windows-installable (the on-premise section's source).