--- title: "Incident ledger - Trooth" description: "Trooth's append-only ledger of security and availability incidents affecting customers, with scope and timeline." canonical_url: "https://trooth.co/incidents" markdown_url: "https://trooth.co/incidents.md" generated_from: "the rendered page, converted to Markdown when this was requested" agent_index: "https://trooth.co/llms.txt" --- # Every incident, disclosed here. Incident ledger · Opened 2026-07-24 · Append-only Every security or availability incident affecting customers is recorded here with scope and timeline. Entries are **append-only**, timestamped in version control, never quietly edited. ## The ledger ### Health check failed for 10 minutes 1. 2026-08-29 · resolved 2026-08-29 trooth.co's health check reported the site unhealthy from 17:42 to 17:52 UTC. Which of its checks failed was not recorded, and the logs from that day are no longer kept, so we cannot say whether any customer request failed. Signed-in pages that depend on the failing part may have returned errors during those minutes. - 2026-08-29 17:42 UTC: the health monitor first saw an unhealthy answer. - 2026-08-29 17:52 UTC: healthy again, without a change by Trooth. - 2026-10-08: entered here, late, after a review of the monitoring record against this ledger. ### Sign-up and five other forms refused submissions 2. 2026-08-27 · resolved 2026-08-27 Forms protected against bots (sign-up, password reset, feedback, document requests, requests for a network reading, and subscriptions) refused every submission because the production bot-protection secret was missing. A change that afternoon made a missing secret refuse requests instead of letting them through. Before that change, the same missing secret meant bot protection was silently off on those forms. That was a weakness, not a known attack. - 2026-08-27 about 15:27 UTC: a release made a missing bot-protection secret refuse submissions. The production secret was missing, so the forms began refusing. - 2026-08-27 16:02 UTC: the health monitor reported bot protection unhealthy. - 2026-08-27 about 16:43 UTC: the real secret was set in production and the site redeployed; the provider accepted it and the forms worked again. - 2026-10-08: entered here, late, after a review of the monitoring record against this ledger. ### Database-level tenant isolation was not in force 3. 2026-08-25 · resolved 2026-08-26 Every workspace's data. The database role serving requests could bypass row-level security, the database's own rule that each workspace sees only its rows, and before August 13 requests ran as the tables' owner, which bypasses it too. The application's own checks, which scope every request to the signed-in workspace, applied throughout: an audit of all 109 server routes on August 25 found none that lets a caller name another workspace's data. We know of no access to one workspace's data by another. - 2026-08-25: found while testing tenant isolation against a role that cannot bypass it. - 2026-08-26 01:00 UTC: production's health check began reporting the request-serving role as able to bypass row-level security. - 2026-08-26 04:54 UTC: production moved to a new role created with SQL that cannot bypass row-level security; the health check has passed since 04:59 UTC. - 2026-10-08: entered here, late, after a review of the monitoring record against this ledger. ## How to report Report security issues through the [vulnerability disclosure program](https://trooth.co/security/vulnerability-disclosure-policy) and factual errors through the [correction path](https://trooth.co/network/dispute). On this page 1. The ledger 2. How to report ## Structured data ```json { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://trooth.co/#org", "name": "Trooth", "legalName": "Trooth, LLC", "alternateName": [ "Trooth, LLC", "Trooth Network", "trooth.co" ], "url": "https://trooth.co", "logo": { "@type": "ImageObject", "@id": "https://trooth.co/#logo", "url": "https://trooth.co/brand/trooth-mark_black-on-white_1024.png", "contentUrl": "https://trooth.co/brand/trooth-mark_black-on-white_1024.png", "width": 1024, "height": 1024, "caption": "Trooth" }, "image": { "@id": "https://trooth.co/#logo" }, "description": "Trooth is an infrastructure and cybersecurity company providing Machine-Readable Trust. The Trooth Network keeps one current Machine-Readable Trust Profile per company, each fact sourced. Trooth signs what it witnessed; company declarations are unsigned.", "foundingDate": "2025-12-16", "address": { "@type": "PostalAddress", "streetAddress": "777 Brickell Ave, Suite 500, PMB 1174", "addressLocality": "Miami", "addressRegion": "FL", "postalCode": "33131", "addressCountry": "US" }, "contactPoint": { "@type": "ContactPoint", "contactType": "customer support", "email": "hello@trooth.co", "url": "https://trooth.co/contact" }, "sameAs": [ "https://x.com/Troothllc", "https://github.com/troothllc", "https://www.crunchbase.com/organization/trooth", "https://www.wikidata.org/wiki/Q141292994", "https://www.youtube.com/@Troothllc", "https://www.trustpilot.com/review/trooth.co" ] }, { "@type": "WebSite", "@id": "https://trooth.co/#website", "url": "https://trooth.co", "name": "Trooth", "alternateName": "Trooth Network", "inLanguage": "en", "publisher": { "@id": "https://trooth.co/#org" }, "sameAs": [ "https://trooth.co/network/company/trooth" ], "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://trooth.co/network?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "ItemList", "@id": "https://trooth.co/#sitelinks", "name": "Trooth sitelinks", "itemListElement": [ { "@type": "SiteNavigationElement", "position": 1, "name": "Join Trooth for free", "url": "https://trooth.co/signup" }, { "@type": "SiteNavigationElement", "position": 2, "name": "Company, Trooth", "url": "https://trooth.co/network/company/trooth" }, { "@type": "SiteNavigationElement", "position": 3, "name": "Trooth Network", "url": "https://trooth.co/network" } ] } ] } ```