Technical whitepaper

Proof, not noise — the engineering story

The full technical case for CarbonMantis, written for security-owning engineers: how findings earn trust through evidence, how the platform is built to the standard it sells, and where automation ends and expert humans begin.

What's inside

Confidence-rated findings

The three-tier confidence model and the evidence package behind every finding.

Platform security

Tenant isolation, per-tenant envelope encryption, execution-plane isolation, SSRF defense, evidence redaction.

Verifiable evidence

Cryptographically signed, append-only attestations anchored to WORM storage — independently verifiable offline. Don't trust us; verify.

Architecture & scale

Contract-first APIs, queue-driven idempotent workflows, the scan state machine, and observability.

Detection freshness

How detections stay current within hours — without giving scan workers internet access — and stay reproducible.

Developer workflow

CLI, version-controlled config, SARIF, deterministic gates, and standards alignment.

Scope & limitations

An honest map of what CarbonMantis automates, and what still needs an expert human.