Trust you can curl.
WAVE's security posture isn't a PDF you request from sales — it's a live, machine-readable surface. Report a vulnerability at the well-known path, see the policy for how it's handled, and read the model for how every request is enforced — all verifiable right now.
curl -s https://trust.wave.online/.well-known/security.txt → Contact, Expires, Canonical, Policy, AcknowledgmentsNothing to take on faith
The security contact and disclosure policy ship as an RFC 9116 security.txt at the well-known path — curl it, and Contact, Expires, Canonical, Policy, and Acknowledgments are all there. Auth, scope, entitlement, and metering aren't scattered per-endpoint checks: they run at one gateway (api.wave.online) that fails closed, returning 403 when an account isn't entitled. One choke point is one thing to audit, not fifty.
One gate, the whole platform
That single gate isn't this page's gate — it's the platform's. Every WAVE spoke federates auth and metering through the same enforcement plane, so trust isn't a per-product bolt-on that drifts out of sync; it's one surface the whole platform inherits. Report once, and it routes to the team that owns every product behind the wave.online line.