Evidence, status, and boundaries · 证据、状态与边界
AstroBridge Trust Center
Inspect the public facts and controls behind AstroBridge and MA. Every item identifies its source, status, update date, and what the evidence does—and does not—prove.
核验 AstroBridge 与 MA 背后的公开事实和技术控制。每项证据均标明来源、状态、更新时间，以及它能够和不能够证明的内容。
Last reviewed / 最近复核：27 September 2026 · 2026年9月27日
Company factsDocument-backed / 正式文件核对
Public controlsSource and policies / 代码与政策
External checksAutomated assessments / 自动化检测
Internal evidenceEngineering records / 工程记录
Evidence register · 证据登记
Publicly inspectable evidence
Links open the current public source or live assessment page. Scores and workflow results can change after a new deployment or scan. / 链接指向当前公开来源或实时检测页面；新部署或重新扫描后，分数与工作流结果可能变化。
Automated assessment / 自动化检测MDN Observatory, SSL Labs, Internet.nl, CodeQL, and OpenSSF Scorecard are technical signals produced by automated tools. They are not government approval, regulatory licensing, legal compliance certification, or a complete security audit.
证据边界MDN Observatory、SSL Labs、Internet.nl、CodeQL 与 OpenSSF Scorecard 是自动化工具产生的技术信号，不等于政府批准、监管许可、法律合规认证或完整安全审计。
Company identity / 公司身份Government-issued
Hong Kong Certificate of Incorporation / 香港公司注册证明书
The Hong Kong Companies Registry issued Certificate No. 81225055 to AstroBridge Technology Limited on 14 September 2026. The original PDF and its SHA-256 fingerprint are published on the company page; current registry status should still be checked through the official registry. / 香港公司注册处于2026年9月14日向 AstroBridge Technology Limited 签发编号 81225055 的公司注册证明书。原始 PDF 与 SHA-256 指纹已在公司页面公开；当前登记状态仍应通过官方注册处复核。
Public controls / 公开控制Published
Source, security policy, and security.txt / 源码与安全政策
The public repository, vulnerability reporting policy, and standard security contact file make project ownership and reporting paths inspectable. / 公开代码库、漏洞报告政策与标准 security.txt，使项目代码和安全报告路径可以核验。
Static analysis / 静态分析Publication pending
GitHub CodeQL
The CodeQL workflow is prepared and awaiting publication through an authorized GitHub workflow update. No scan result is claimed until the first workflow completes. / CodeQL 工作流已准备完成，正等待通过获得授权的 GitHub 工作流更新发布；首次运行完成前，不对结果作任何“通过”表述。
Supply-chain posture / 供应链状态Publication pending
OpenSSF Scorecard
The Scorecard workflow is prepared and awaiting publication through an authorized GitHub workflow update. A score will be shown only after a successful public run. / Scorecard 工作流已准备完成，正等待通过获得授权的 GitHub 工作流更新发布；只有公开运行成功后才会展示分数。
Web headers / 网页响应头Automated assessment
MDN HTTP Observatory
The 27 September 2026 scan returned grade B, 75/100, with 10 checks passed and 2 failed. The linked result remains the source of truth because configuration and scoring can change. / 2026年9月27日检测结果为 B 级、75/100，10 项通过、2 项未通过。配置与评分可能变化，最新状态以链接结果页为准。
TLS configuration / TLS 配置Automated assessment
Qualys SSL Labs Server Test
The 27 September 2026 test rated the two served IPv4 endpoints A+ and A. Results can differ by endpoint and deployment, so the live report should be checked before relying on the grade. / 2026年9月27日检测中，两个 IPv4 服务端点分别获 A+ 与 A；评分可能随端点和部署变化，使用前应复核实时报告。
Internet standards / 互联网标准Automated assessment
Internet.nl Website Test
The 27 September 2026 test scored 55%. HTTPS and RPKI passed; DNSSEC and IPv6 failed, and the security-options category recorded recommendations. These gaps are published rather than presented as a pass. / 2026年9月27日检测得分 55%；HTTPS 与 RPKI 通过，DNSSEC 与 IPv6 未通过，安全选项仍有改进建议。本页公开这些差距，不将其包装为“已通过”。
Engineering evidence / 工程证据Internal report
MA / AstroBridge integration readiness
A dated internal report separates tested implementation, observed production endpoints, and deployment work that remained pending at the report date. / 有日期的内部报告将已测试实现、已观察的生产端点与报告时仍待部署的工作分开记录。
Claim register · 声明登记
What each label means
We publish a label only when the underlying evidence exists. Pending work remains visibly pending. / 只有底层证据真实存在时才发布相应标签；未完成的项目始终明确标注为待完成。
| Label | Evidence owner | Meaning | Does not mean |
|---|
| Document-checked / 文件已核对 | AstroBridge record review | Fact matched to an official company document. | Government endorsement or regulated licence. |
| Published / 已公开 | AstroBridge public repository | The control or policy can be inspected publicly. | Proof that no defect or vulnerability exists. |
| Automated assessment / 自动化检测 | Named external tool | The tool checked its documented technical scope. | Manual audit, certification, or legal compliance. |
| Internal report / 内部报告 | AstroBridge engineering | A dated record of specified builds, tests, and observations. | Independent assurance or third-party security audit. |
| Pending / 待完成 | Named workflow or application | The control is prepared or enabled, but a result is not yet claimed. | A pass, award, certification, or completed review. |
Publication rule · 发布规则
Evidence before badges
Free programs and public scanners can improve transparency, but a badge is published only after the current result can be verified. / 免费项目和公开检测可以提升透明度，但只有当前结果可被核验后才会展示徽章。
- Prepare / 准备Publish the relevant policy, control, or technical change and identify its owner.
- Verify / 核验Run the external check or workflow, inspect the result, and preserve its date and scope.
- Describe accurately / 准确说明Publish the result with its limits; remove or update stale evidence when the underlying state changes.