vyrox-security · keirsalterego · Jun 9, 2026 · Jun 9, 2026
diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml
@@ -5,7 +5,7 @@ body:
   - type: markdown
     attributes:
       value: |
-        Before filing: check that this is not a known limitation documented in SECURITY.md. If the bug involves a security vulnerability, do not file here. Email security@vyrox.security instead.
+        Before filing: check that this is not a known limitation documented in SECURITY.md. If the bug involves a security vulnerability, do not file here. Email security@vyrox.dev instead.
 
   - type: textarea
     id: what-happened
@@ -72,5 +72,5 @@ body:
           required: true
         - label: I have redacted all secrets and tenant data from this report.
           required: true
-        - label: This is not a security vulnerability. If it is, I will email security@vyrox.security instead.
+        - label: This is not a security vulnerability. If it is, I will email security@vyrox.dev instead.
           required: true
diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md
@@ -22,4 +22,4 @@ This organisation builds software that can trigger containment actions on produc
 
 Maintainers may edit, lock, or remove content and restrict participation when conduct degrades the safety or usefulness of the project.
 
-For security-sensitive concerns, contact security@vyrox.security.
+For security-sensitive concerns, contact security@vyrox.dev.
diff --git a/README.md b/README.md
@@ -4,7 +4,6 @@
 ![Build](https://img.shields.io/badge/build-passing-2ea44f?style=flat-square)
 ![Version](https://img.shields.io/badge/version-v0.1.0-005cc5?style=flat-square)
 ![Platform](https://img.shields.io/badge/platform-github-24292f?style=flat-square)
-![Funny](https://img.shields.io/badge/incidents-preferably%20in%20daylight-6a737d?style=flat-square)
 
 This repository holds the shared policy, templates, and workflow guardrails used across the public Vyrox repositories, so every bug report, pull request, and security disclosure lands in a format maintainers can actually act on. It exists separately because organisation-wide community health files should have one owner, one history, and one place to audit, especially when the broader product uses an open-core model where public trust is anchored in what security teams can inspect before they let code near production systems.
 
@@ -90,4 +89,4 @@ See CONTRIBUTING.md for full contribution process, style expectations, and merge
 
 This repository is distributed under Vyrox organisation terms for public community files. See LICENCE in the relevant target repository for component-specific licence terms.
 
-Website: vyrox.dev (coming soon)
+Website: [vyrox.dev](https://vyrox.dev) · General: hello@vyrox.dev · Security: security@vyrox.dev
diff --git a/SECURITY.md b/SECURITY.md
@@ -13,7 +13,7 @@ Versions prior to `v0.1.0` are not supported and should not be deployed.
 
 Do not open a public GitHub issue for security reports.
 
-Email: `sec.vyrox@proton.me`
+Email: `security@vyrox.dev`
 
 Subject line format:
 
@@ -42,8 +42,8 @@ In scope:
 
 Out of scope:
 
-- OpenRouter free-tier model hallucinating a verdict
-- Discord bot UI quality complaints
+- The LLM model returning a low-quality verdict (this is a triage-quality matter, not a vulnerability)
+- Notifier UI quality complaints
 - Any scenario requiring physical server access
 
 ## Disclosure Policy
@@ -54,7 +54,7 @@ There are no bounty payouts during alpha.
 
 ## Known Limitations
 
-- OpenRouter free tier has a 20k token/day cap. This is an operational constraint.
-- SQLite single-writer behavior is not suitable above roughly 50k alerts/day per tenant.
+- The LLM triage path runs under a configurable daily token budget; once it is exhausted, alerts fall back to a conservative deterministic verdict.
+- The pilot single-writer datastore is not sized for sustained very-high alert volume per tenant; the platform moves to a horizontally scalable store before that becomes a constraint.
 
 These are known system limits, not security vulnerabilities.
diff --git a/profile/README.md b/profile/README.md
@@ -2,54 +2,67 @@
 
 <p align="center">
   <img src="https://img.shields.io/badge/status-alpha-red?style=for-the-badge" alt="Status">
-  <img src="https://img.shields.io/badge/containment-human%20approved%20only-black?style=for-the-badge" alt="Containment policy">
-  <img src="https://img.shields.io/badge/automation-judged%20by%20people%2C%20not%20mood-cyan?style=for-the-badge" alt="Automation policy">
-  <img src="https://img.shields.io/badge/alerts-processed%20with%20extreme%20suspicion-orange?style=for-the-badge" alt="Alerts policy">
+  <img src="https://img.shields.io/badge/action%20layer-for%20security%20ops-black?style=for-the-badge" alt="Action layer">
+  <img src="https://img.shields.io/badge/containment-human%20approved%20by%20default-blue?style=for-the-badge" alt="Containment policy">
+  <img src="https://img.shields.io/badge/every%20action-audited%20%26%20provable-2ea44f?style=for-the-badge" alt="Audit policy">
 </p>
 
-<p align="center">
-</p>
+# Vyrox
+
+**The autonomous, auditable action layer for security operations.**
+
+Detection is solved. Response is not. An alert fires, lands in a queue, and at 2am
+nobody is home. When someone does act, no one can reconstruct afterward what was
+done or why. Teams bought detection and were left alone with the hard part.
 
-## What It Does
-Vyrox is the slightly overcaffeinated AI SOC analyst that reads the alert queue, squints at it, and then asks a human before touching anything dangerous.
+Vyrox acts on the alert and proves it. We triage every EDR alert, take action on the
+ones that are real, and write every action to a tamper-evident log the customer owns.
+
+## How it works
 
 ```
-[EDR Alert] --> [Ingest] --> [Heuristics] --> [LLM triage] --> [Human Approval] --> [Action]
+[EDR alert] -> [Ingest] -> [Heuristics] -> [LLM triage] -> [Decide] -> [Act] -> [Audit]
 ```
 
-1. **Ingest** - CrowdStrike and SentinelOne webhooks arrive like they pay rent here.
-2. **Triage** - Deterministic heuristics handle most of the obvious nonsense.
-3. **Escalate** - Ambiguous cases get a second opinion from the LLM.
-4. **Approve** - HIGH/CRITICAL alerts surface with enough context to make a sane decision.
-5. **Execute** - Approved actions hit the hardened Rust proxy, because chaos deserves guardrails.
+1. **Ingest** - CrowdStrike, SentinelOne, Defender, and a field-mapped generic adapter post alerts to a per-tenant webhook, authenticated with HMAC-SHA256.
+2. **Triage** - A deterministic heuristics engine clears the obvious noise in milliseconds. Only the genuinely ambiguous alerts reach an LLM, which writes verdict fields and never executes anything.
+3. **Decide** - Human approval by default. Autonomous only where the customer has turned it on and the action is reversible.
+4. **Act** - Approved containment runs through a small, hardened Rust proxy: signed, rate-limited, and built to fail closed.
+5. **Prove** - Every action lands in a SHA-256 hash-chained audit log the customer owns, ready for an auditor or an insurer.
 
-The important bit: **no autonomous containment**. Humans approve before anything gets isolated, killed, or dramatically overreacted to.
+## Who it is for
 
-## Repositories
+Sold MSSP-first: one analyst runs many client tenants from a single console and can
+prove every action to each client's auditor. Lean in-house teams that own security but
+have no 24/7 SOC come in through the inbound door.
 
-| Repo | Description | License | Stars |
-|------|-------------|---------|-------|
-| [vyrox-proxy](https://github.com/vyrox-security/vyrox-proxy) | Rust containment proxy for the important kind of panic | MIT | ![vyrox-proxy stars](https://img.shields.io/github/stars/vyrox-security/vyrox-proxy?style=flat-square) |
-| [vyrox-docs](https://github.com/vyrox-security/vyrox-docs) | Architecture docs for the stuff everyone pretends not to read | Proprietary | ![vyrox-docs stars](https://img.shields.io/github/stars/vyrox-security/vyrox-docs?style=flat-square) |
-| [vyrox-simulator](https://github.com/vyrox-security/vyrox-simulator) | Alert simulation, because production is a terrible place to improvise | Proprietary | ![vyrox-simulator stars](https://img.shields.io/github/stars/vyrox-security/vyrox-simulator?style=flat-square) |
-| [vyrox-landing](https://github.com/vyrox-security/vyrox-landing) | Public marketing site with just enough polish to be dangerous | Proprietary | ![vyrox-landing stars](https://img.shields.io/github/stars/vyrox-security/vyrox-landing?style=flat-square) |
+## Open core
 
-## Why Open Core
+The execution proxy is MIT licensed. If a piece of software can isolate a production
+host, the people running it should be able to read exactly what it does before they
+trust it. The heuristics corpus and the orchestration core stay private: that is the
+product, and handing detection logic to attackers helps no one.
 
-The proxy is MIT because if software can isolate a production host, the public should at least be able to audit the melodrama.
+## Repositories
 
-The heuristics stay proprietary because that is the actual product, and shipping detection logic publicly would be a very generous gift to the other team.
+| Repo | What it is | License |
+|------|-----------|---------|
+| [vyrox-proxy](https://github.com/vyrox-security/vyrox-proxy) | Rust containment proxy, the audited execution boundary | MIT |
+| [vyrox-docs](https://github.com/vyrox-security/vyrox-docs) | Public architecture, API contracts, threat model, audit-chain spec | Proprietary |
+| [vyrox-simulator](https://github.com/vyrox-security/vyrox-simulator) | Deterministic alert simulation for exercising the pipeline | MIT |
+| [vyrox-www](https://github.com/vyrox-security/vyrox-www) | Public product site | Proprietary |
 
-## Quick Links
+## Contact
 
 - Website: [vyrox.dev](https://vyrox.dev)
-- Security issues: vyrox.sec@proton.me
-- PGP key: [vyrox.dev/.well-known/pgp-key.txt](https://vyrox.dev/.well-known/pgp-key.txt)
-- Report vulnerabilities: [SECURITY.md](https://github.com/vyrox-security/.github/blob/main/SECURITY.md)
+- General: hello@vyrox.dev
+- Security: security@vyrox.dev (see [SECURITY.md](https://github.com/vyrox-security/.github/blob/main/SECURITY.md) and the [PGP key](https://vyrox.dev/.well-known/pgp-key.txt))
 
 ## Status
 
-Alpha. Breaking things. Moving fast. Wearing a hard hat.
+Alpha. Shipping today: the Rust proxy, ingestion, two-stage triage, human-approved
+containment, and the SHA-256 audit chain. In active build: the operational console,
+graduated autonomy, and the evidence engine.
 
 
 <!-- contributors start -->
@@ -66,4 +79,4 @@ Alpha. Breaking things. Moving fast. Wearing a hard hat.
 
 ---
 
-Built for analysts who deserve real signal, not 300 false positives per shift.
+Built for analysts who deserve real signal, not 300 false positives a shift.
Original file line number	Diff line number	Diff line change
Expand Up		@@ -22,4 +22,4 @@ This organisation builds software that can trigger containment actions on produc

		Maintainers may edit, lock, or remove content and restrict participation when conduct degrades the safety or usefulness of the project.

		For security-sensitive concerns, contact security@vyrox.security.
		For security-sensitive concerns, contact security@vyrox.dev.