Context
Identify source, asset, observation, time, uncertainty and supported business relevance without turning a suspected signal into an asserted incident.
ASSAYMARK FRAMEWORK · ASEPRF v1.3
Security evidence should lead to an understandable, accountable remediation decision
ASEPRF is the AssayMark Security Evidence, Prioritisation and Remediation Framework. Version 1.3 is the Implementation and Validation Edition: it consolidates the methodology, aligns the technical explanation with source base 10.3.3f plus the v2.3 analyzer patch, and records current validation and operational evidence without presenting that evidence as independent assurance.
CORE WORKFLOW
Context → Priority → Action → Remediation → Verification
Evidence collection precedes the five-stage workflow. Recurrence and remediation memory can inform later assessments, while the presentation layer should preserve detector evidence and identify the scoring or decision mechanism being shown.
Priority
Explain the detector severity or applicable scoring path and keep confidence distinct from urgency.
Action
Provide an existing supported next step, suggested responsible role and target timeframe.
Remediation
Record ownership, implementation activity, status and evidence without inventing fixes or treating accepted risk as remediation.
Verification
Record method, scope, result and evidence. A failed or incomparable re-test is inconclusive, not proof of resolution.
IMPLEMENTATION & VALIDATION EDITION
What v1.3 records
Version 1.3 supersedes v1.2 for operational evidence while preserving the same five-stage method, scoring discipline and conservative verification principles. Framework, product and delivery versions remain separate identifiers.
Duplicate and replay evidence handling
Zero-confidence preservation
Negation and malicious-outcome language boundaries
Per-session logout revocation
Trusted-proxy and forwarded-header boundaries
Remediation lifecycle and comparable re-test rules
Tested behaviour is not a security guarantee.
RECORDED VALIDATION
Current internal evidence — with explicit limits
The recorded results support the exercised source paths and a fix-and-retest process. They do not measure customer breach detection, ranking superiority, calibrated confidence, long-term false-positive rates, performance under load, broad tenancy isolation or complete deployment security.
Benchmark
25/25 selected component scenarios passed. No held-out expert labels were established by this result.
Security checks
16/16 selected local route/helper checks passed. This is not complete production assurance.
Full suite
84 passed in UTC and 84 passed in Europe/London, with no skips. These are the same cases repeated under two timezone configurations.
Language boundaries
12/12 extended language checks and 8/8 outcome-scope checks passed. These task-authored cases are not population-level accuracy evidence.
Server analyzer
20/20 recorded in both staging and production directories from founder-supplied terminal output.
OPERATIONAL EVIDENCE · 30 SEPTEMBER 2026
Selected production paths have been exercised
Founder-supplied terminal output and service logs record Nginx recovery, a production restart under the dedicated
assaymark user, and successful Google login, dashboard, existing-analysis, escalation-report and new website-scan requests.
These records are operational evidence for those paths, not an independent infrastructure audit.
Production HTTPS root observed responding successfully
Google authentication flow recorded successfully
Existing analysis route recorded successfully
Escalation-report endpoint recorded successfully
New website-scan request recorded successfully
Build parity and broader live security assurance remain open.
TRUST BOUNDARIES
What ASEPRF v1.3 does not claim
No certification claim
ASEPRF is not an ISO, NIST, Cyber Essentials, NCSC, OWASP, MITRE or government certification. Mapping establishes relevance only.
No automatic assurance claim
A policy PASS, a closed task and an independently verified remediation are different states. Missing evidence remains visible.
No independent-security claim
Internal validation and founder-supplied operational records are not a penetration test, independent certification or proof of complete platform security.
CURRENT EDITION
ASEPRF v1.3
Edition: Implementation and Validation Edition
Framework update: 30 September 2026
Product alignment: source base 10.3.3f + v2.3 analyzer patch
Version boundary: framework, product and delivery versions are separate identifiers
Evidence identity and confidence
Contextual scoring and Security Memory
Language interpretation boundaries
Remediation and verification
Privacy, authorisation and platform security
Validation and deployment acceptance
14-page current framework document
OPEN ASSURANCE WORK
Known areas still requiring stronger evidence
Exact source-to-running-build checksum parity, malicious and benign uploads through both live environments, broader authorisation and organisation-level tenant isolation, distributed rate-limit behaviour, backup restoration, and independent implementation-level assurance remain outstanding. The previously reported Celery worker failure has no evidenced resolution in this framework update.
READ THE FULL METHODOLOGY
ASEPRF v1.3 — Implementation and Validation Edition
Read the complete framework for workflow, evidence integrity, score semantics, contextual logic, language interpretation, remediation, platform-security boundaries, validation, deployment acceptance and governance.
ASEPRF is an original AssayMark methodology. It is not an ISO, NIST, Cyber Essentials, NCSC, OWASP, MITRE or government certification. A framework mapping establishes relevance only; it does not establish compliance, external endorsement or absence of risk. The current validation and operational evidence does not constitute an independent security certification, penetration test, legal opinion, regulatory approval or guarantee of security, and does not replace appropriate professional, legal, regulatory or incident-response judgement.