DDC Assurance Lab
DDC Assurance Lab is not an accredited laboratory.

Security

Reduce the public attack surface first.

The public information surface is predominantly static. The Try DDC demonstration uses first-party JavaScript and a bounded same-origin PHP endpoint. Administration, client evidence, credentials, and assessment execution are intentionally excluded from this public web boundary.

Public-site architecture

  • No public account registration
  • No public administration endpoint in this release
  • Core informational pages require no JavaScript; Try DDC uses one same-origin client script for the bounded demo workflow
  • No file-upload endpoint
  • No public assessment evidence store
  • No third-party fonts, analytics, or advertising scripts

Public repository demo

The Try DDC demo is a read-only static analysis boundary. It does not clone with credentials, install packages, execute repository hooks or scripts, or run submitted code. Public repository input is resolved to an exact commit before analysis, content retrieval is bounded, and secret-like values are redacted from demo findings.

A clean static preflight is not treated as proof that code is safe to execute. Any future dynamic testing remains a separately authorized and isolated execution transition.

Security disclosure

If you believe you have identified a vulnerability affecting ddcal.ca, contact inquiry@ddcal.ca with the subject Security Disclosure.

Please avoid accessing, modifying, retaining, or disclosing data that is not yours. Do not perform destructive testing or create avoidable service disruption.

Administration

The future DDCAL administrative control plane is being designed as a separate authenticated system. It will not be implemented as an ordinary public CMS login attached to this static website.