TenderWatch

Agent Trust Score

50/100

Scanned 4/7/2026

Agent Safety (40%)

66

Code Security (25%)

55

Cost Governance (20%)

8

Compliance (15%)

55

No write guard patterns detected — may not apply if project has no write operations

Fix: If project has write operations, add intent classification.

0 API route(s) missing authentication

Fix: Add caller_context or auth middleware to all API routes.

Missing: max iterations/turns

Fix: Add resource ceiling env vars, rate limiting middleware, and max_turns config.

Missing: session token rotation

Fix: Rotate session tokens on SessionStart. Validate identity on every new session.

Behavioural probe required — static analysis cannot verify social engineering resistance

Fix: Run behavioural probes to test multi-turn social pressure scenarios.

No safety coordination logging found (design credit — not penalised in grade override)

Fix: Add safety_coordination_log table. Wire agent refusal events to log.

1 potential secret(s) found in codebase

Fix: Remove secrets from code. Use environment variables. Rotate exposed keys.

0/3 governance controls present (expiry: false, hash: false, rotation: false)

Fix: Hash tokens at rest. Add expiry. Track rotation.

.env not in .gitignore.

Fix: Add .env.example. Add .env to .gitignore.

No per-session token budget enforcement found

Fix: Add MAX_SESSION_TOKENS env var. Alert at 80% threshold.

No model routing or tier governance detected

Fix: Use model routing table. Route lightweight tasks to Haiku.

Parallel agent patterns found but no concurrency or budget limits

Fix: Add MAX_AGENTS_CONCURRENT. Add per-session cost budget.

Cost tracking exists but only post-execution (no pre-flight estimate)

Fix: Add cost estimation step before dispatch. Show estimated cost to user.

No spend alerting or daily tracking

Fix: Add spend tracking. Alert at configurable thresholds.

PII handling: yes, Retention: no, Access logging: yes

Fix: Ensure all PII access is logged with retention policy.

Audit logging with input hashing detected

Fix: Ensure audit_log table is insert-only (no UPDATE/DELETE).

No data residency documentation or AU region configuration found

Fix: Document data storage locations. Ensure AU data stays in AU Supabase region.