Trust center.

Wombat is an open-source framework with a public governance process. This page collects the facts a security reviewer, procurement team or partner usually asks for — and tells you where to verify each one.

Open the repository → Governance Compliance hubs

Last reviewed 2026-10-31
Apache 2.0 · CC BY 4.0
Public RFCs · public changelog

What you can verify.

Every card below points to a public source. If something cannot be verified there, it is a question for the maintainers — not a commitment.

Open source, clear licenses

The code and the documentation use standard open licenses, with the repository files as the authoritative source.

Code: Apache License 2.0
Documentation: CC BY 4.0
Authoritative files: LICENSE / NOTICE in the repository and the notes on /legal/

Legal notices → Framework repository →

Security and responsible disclosure

Security issues are reported privately and published in a coordinated way. Do not open a public issue for a vulnerability.

The framework repository contains a SECURITY.md policy.
Use GitHub's private vulnerability reporting / security advisory flow.
Coordinated disclosure is the default; no bug bounty is implied.

Security policy → Report a vulnerability → security.txt →

Governance and decisions

Significant changes go through a public RFC process. Roles, terms and decision rules are documented rather than implied.

RFC-driven decisions with public discussion
TSC, working groups and contributor roles
Code of Conduct applies to all project spaces

Governance & community → RFC tracker → Code of Conduct → Roles & members →

Data handling on this website

The marketing site is static. The scorecard runs in your browser. We do not upload your assessment to a Wombat server.

No server-side database stores assessment results.
The scorecard reads your JSON locally and renders the card in the browser.
Newsletter signup is handled by the configured email provider, not by a Wombat application server.
The rank system publishes only a public GitHub login and the computed rank.

Scorecard → Contributor ranks → Newsletter →

Release transparency

Releases, changes and the roadmap are public. Documentation is versioned alongside the framework.

Public changelog with versioned entries
Public roadmap and RFC tracker
Versioned Antora documentation

Changelog → Roadmap → Documentation →

Contributing and conduct

Contribution rules, review expectations and community conduct are documented in the repository and on the site.

CONTRIBUTING.md in the framework repository
CODE_OF_CONDUCT.md in the framework repository
Good first issues and public discussions

Contributing → Good first issues → Discussions →

How to verify the claims on this page

Every item above links to a public source. If a claim cannot be verified from the repository, the licenses or the public documentation, treat it as a question for the maintainers — not as a commitment.

Read LICENSE, NOTICE and SECURITY.md in the framework repository.
Check the RFC tracker and the governance page for decision history.
Read the versioned documentation for the controls and their evidence expectations.
Use the public issue tracker or discussions for anything that is not documented.

Need a security or procurement conversation?

Start with the public sources, then bring the specific question to the community. The governance page explains the channels.

Governance & community → Open the compliance hubs

This page is a summary of public commitments. It is not a certification, an audit opinion or a legal opinion. The authoritative sources are the repository files, the licenses and the official project documentation.