# Supply-Chain Security & Security Policy
Rivox enforces supply-chain attestation and process isolation across all coordinated builds.
---
## Security Model
1. **Zero New Trust Root**: All package signatures and metadata derive from PyPI, crates.io, and npm's existing security infrastructure.
2. **Process Isolation**: Native build scripts run inside unprivileged Linux namespaces or macOS Seatbelt sandboxes.
3. **Environment Scrubbing**: Sensitive host environment variables (`AWS_SECRET_ACCESS_KEY`, `GITHUB_TOKEN`) are scrubbed from sandbox execution contexts.
4. **Deterministic Auditing**: All builds produce signed in-toto, SLSA Level 2, SPDX 2.3, and Sigstore/Rekor attestations.
See also: [provenance.md](provenance.md), [sandbox.md](sandbox.md).