Home / Security

Audit the code. Run it in your VPC.

Recordings stay on your machine, and every network action is one you named.

$ git clone github.com/attenlabs/hotato
hotato · conversation verify
pip install hotato
# -> zero runtime dependencies pulled
$ hotato conversation verify ./call-artifact
  manifest         recomputed
  evidence tier    attested
  signature        verifies
exit 0
A verdict re-derives from its own inputs.

Offline by default.

Scoring, reports, and the workspace read and write local files only.

Proxy variables are honored like curl and pip, and TLS validation stays on.

Every command, and when it reaches the network
CommandEgressReaches, and when
run, report, assert run, test run (local judge), servenoneLocal only. Reads the files you point it at, writes local files, opens no socket.
connectnoneStores a stack's credentials at file mode 0600; no round-trip on store.
capture, pull, sweepyour providerFetches the recordings you named into a local folder.
inspectyour providerReads the current turn-taking config. Read-only.
hosted judge --judge-provider hostedrefusedRefused unless you pass --judge-egress-opt-in. The default judge is a local model.
hosted diarizer --diarizer pyannoteairefusedThe one off-box audio path, refused unless you pass --egress-opt-in.
drive a live call (Vapi / Twilio)double-gatedPlaces a billable call only with valid credentials and HOTATO_DRIVE_OPT_IN=1.

The gated rows stay refused until you opt in yourself. Self-host the workspace in your VPC →

Evidence tier: none to attested.

A report's evidence tier: weakest dimension wins, never an average.

  • tier 0none
  • tier 1asserted
  • tier 2measured
  • tier 3paired
  • tier 4attested

asserted: your word, not recomputed from audio. measured: one clean recording, recomputed. paired: a before/after in one manifest, both recomputed under one pinned (frozen) policy. attested: paired, plus a signed manifest and a runner-vouched capture origin. A shared-key HMAC shows the file is unedited, not who wrote it: it caps at paired.

verify re-hashes the bound children, then checks the signature.
Signed manifest, capture origin attested, key verifiesattested
Audio swapped after signing, hash no longer matchesrefused
Verified with the wrong public keyrefused
A tampered proof is refused, at tier none.

Ed25519 signing is opt-in via the [sign] extra and verifies from the public key alone; shared-key artifacts use HMAC-SHA256. The recording has its own four tiers.

Three guarantees that always hold.

The same boundaries whether you run offline, self-hosted, or in CI.

Guarantee 01

Never mutates production by default

plan and patch write proposals; apply runs on a staging clone and dry-runs by default.

Guarantee 02

Never uploads recordings to Attention Labs

Audio moves from your stack to your disk only on a pull, capture, or sweep.

Guarantee 03

Never treats a webhook as instructions

The ingest worker extracts a recording reference and scans it. Payload fields are never executed.

Read the full threat model. Send vulnerabilities to [email protected]; keep recordings, consent, and PII out of public issues.

Prove it yourself. Offline.

autopsy reads one recording and lists its incidents, on your own machine.

$ hotato autopsy ./call.wav

Run it in your own VPC. Self-host →