言行一致，知行合一

公开透明的工程质量

Hyperion 用审计客户系统的同一套方法,审计并追踪自己的系统。用数据说话,而非幻灯片。

最后更新: 2026-05-02

综合审计得分

9.0/ 10

始于 6.0

得分来自涵盖 20 条工作流的内部审计,涉及安全、可观测性、依赖项卫生、SEO 与 CI/CD。

各组审计进度

Auth & CSRF8/8 项已交付

SSRF & LLM hardening6/6 项已交付

VPS hardening9/12 项已交付

CI/CD & dependencies10/10 项已交付

Observability3/3 项已交付

SEO & GEO3/3 项已交付

32 of 65 admin routes validate CSRF server-side (the rest are GET-only, do not need it)
10 → 3 production CVE advisories (the 3 remaining are uuid CVSS 0, accepted risk)
Post-quantum SSH key exchange enabled (sntrup761x25519-sha512)
Mistral-only AI runtime, EU-hosted (OVH France), GDPR-resident by construction
Edge middleware admin gate + JWT pinned to HS256 + per-IP token-budget cap on chat
Pre-push hook runs full local CI gate (lint, typecheck, i18n, test, build) before push
All third-party GitHub Actions SHA-pinned, branch protection on main

我使用与提供给客户相同的分类器。每一处涉及 AI 的界面均已声明。

Chat widget: minimal-risk
EU AI Act classifier: limited-risk (regulatory information tool — Article 50 transparency obligations)
Use Case Generator: minimal-risk

最近 5 项已部署至生产环境的变更。

Hyperion 的审计为客户交付同一套仪表盘——综合得分、各组进度、EU AI Act 分类、安全态势。

当前安全态势

32 of 65 admin routes validate CSRF server-side (the rest are GET-only, do not need it)

10 → 3 production CVE advisories (the 3 remaining are uuid CVSS 0, accepted risk)

Post-quantum SSH key exchange enabled (sntrup761x25519-sha512)

Mistral-only AI runtime, EU-hosted (OVH France), GDPR-resident by construction

Edge middleware admin gate + JWT pinned to HS256 + per-IP token-budget cap on chat

Pre-push hook runs full local CI gate (lint, typecheck, i18n, test, build) before push

All third-party GitHub Actions SHA-pinned, branch protection on main

近期活动

最近 5 项已部署至生产环境的变更。

2df539f5chore(devx): add .vscode/extensions.json2026-05-02

005aad83sec(ai): finish B4 — RAG role-boundary fix2026-05-02

5d9870b2fix(security): server-side CSRF on 27 admin routes2026-05-02

028234c9chore(deps)/sec: F3 — bump aws-sdk + pnpm overrides2026-05-02

62756701fix(security): close CSRF gap on 4 admin clients2026-05-02