generated: '2026-07-19'
method: searched
source: openapi/kernel-openapi-original.yml + https://www.kernel.sh/security + well-known
standards:
  - id: openapi-3.1
    conforms: true
    evidence: openapi/kernel-openapi-original.yml is OpenAPI 3.1.0.
  - id: oauth2.1
    conforms: true
    evidence: >-
      /.well-known/oauth-authorization-server advertises OAuth 2.1 with dynamic client
      registration; used by the hosted MCP server.
  - id: rfc8414-authorization-server-metadata
    conforms: true
    evidence: /.well-known/oauth-authorization-server returns 200 with issuer/scopes metadata.
  - id: bearer-token-auth
    conforms: true
    evidence: securitySchemes bearerAuth (http bearer) applied globally.
  - id: rfc6585-rate-limiting
    conforms: true
    evidence: 429 Too Many Requests responses with Retry-After header.
  - id: server-sent-events
    conforms: true
    evidence: Multiple text/event-stream SSE streaming endpoints (events, telemetry, logs).
  - id: rfc9457-problem-details
    conforms: false
    evidence: Errors use a custom {code, message, details} JSON envelope, not application/problem+json.
  - id: rfc9116-security-txt
    conforms: false
    evidence: No /.well-known/security.txt published.
  - id: openid-connect
    conforms: false
    evidence: No /.well-known/openid-configuration.
compliance:
  program_published: true
  page: https://www.kernel.sh/security
  trust_center: https://trust.kernel.sh
  frameworks: [SOC 2, ISO 27001, HIPAA, PCI, GDPR]
  note: >-
    Certifications/frameworks are claimed on the public security page and Kernel's
    Vanta-hosted trust center. See security/kernel-trust-center.yml.