A security tool should be the safest thing in your cluster
Praxis is built to need as little trust as possible — and to make what it does need verifiable.
Read-only by design
The collector’s ClusterRole allows get, list and watch only. It has no write verbs and cannot read Secrets.
Generate, never apply
Praxis produces policy files for your team to review. It has no permission to change a policy, and audit mode is the default.
Signed and accounted for
Offline bundles ship with signed checksums and an SBOM; the image ID is published so you can check what you load.
Locked supply chain
Base images pinned by digest and every third-party package installed from a hash-locked list. Runs as a non-root user.
Deterministic core
No model decides anything. The optional AI explanation runs where you choose, and the scoring never depends on it.
Vulnerability reports
Found something? Tell us through the contact page; our security.txt follows RFC 9116.
See your own clusters ranked
Bring one cluster. We run the read-only collector with you and walk through the list it produces.