Every Cloudflare Worker behind api.trooth.co now has a public software bill of materials, and two claims on Trooth's own Trust Profile were corrected to match its policies.
What changed
Each of the eight Cloudflare Workers behind api.trooth.co now has a public software bill of materials, one CycloneDX file per Worker listing every package its lockfile resolves, with the repository commit it was read at. Until today only the web application had one. Trooth's own Trust Profile also said two things its policies did not: a list price of By quote, while Trooth is free, and a one-hour recovery point objective, while the continuity policy states 24 hours. Both now match the policy.
Why it changed
Only the web application had a bill of materials, and Trooth's own record contradicted its policies on price and on recovery point.
Who is affected
- Affected: Security reviewers checking what Trooth runs, and anyone who read Trooth's own Trust Profile before the correction.
- Availability: Public. No account needed.
- Release stage: Available.
- Areas: Platform, Trust Profiles.
What to do
No action required. The bills are new files and the corrected values are Trooth's own. Nothing that existed changed shape.
Dates
- Announced: September 26, 2026, the day this entry was written. Entries are never backdated.
- Released: September 26, 2026.
- Trooth's record corrected and read back: September 26, 2026.
What this does not fix
A Worker's bill is read from its lockfile, not from the script Cloudflare serves. The web application's bill lists direct dependencies; its lockfile holds the rest.
Corrections and later changes
- Corrected September 26, 2026: Trooth's Trust Profile listed a price of By quote and a one-hour recovery point objective. Both now match policy: Trooth is free, and the recovery point objective is 24 hours.