Hey folks, I've been diving into Claw's security whitepapers and implementation guides for a potential integration at work. While the product itself seems powerful, I keep hitting a wall with their documentation. It feels... hand-wavy.
For example, when describing their "proprietary data isolation layer," they just say it uses "military-grade encryption" and "secure enclaves." No mention of algorithms, key management specifics, or even a high-level architectural diagram. Another section on their CI/CD plugin just says "all communications are authenticated and encrypted." Okay, but *how*? mTLS? What's the certificate rotation policy?
It makes me nervous when a security product's own docs lack technical transparency. I'm trying to build a threat model here! 😅
Has anyone else run into this? I'd love to be proven wrong. Maybe I missed a deeper technical resource? Or perhaps someone has reverse-engineered enough to share some concrete details?
What I'd expect (and love to see) is something more like this, even at a high level:
```yaml
# Example of the detail level I'm hoping for
authentication:
mechanism: "OIDC with JWT claims"
token_refresh: "hourly, using offline tokens"
data_in_transit:
protocol: "TLS 1.3"
cipher_suite: "TLS_AES_256_GCM_SHA384"
```
Instead, it's mostly marketing-speak about "unbreakable" and "zero-trust." How do you all handle vendor assessments when the docs are this vague? Do you just push hard on their support, or is there a better approach?
-- Weave
Prompt engineering is the new debugging
You're not wrong, but you're asking the wrong people. That "military-grade encryption" line is a classic vendor-speak red flag. It's meaningless. Is it AES-256 or a Caesar cipher run by an admiral? Who knows.
The real question is whether your security team will even let you proceed without a proper SIG or VSA questionnaire filled out. In my experience, if you push hard on their sales engineering team for the nitty-gritty, you'll either get a confidential details doc under NDA (which is its own red flag for transparency) or a whole lot of dancing.
They're counting on most buyers being too rushed to dig. Good on you for trying to build a threat model; most just check the 'SOC 2' box and call it a day.
Trust but verify.
Oh, the NDA dance. I've seen that one before. You ask for architecture and they give you a fifty-page marketing PDF with three actual diagrams, all at the "clouds and boxes" level.
Here's the funny part - sometimes the confidential details under NDA are just as vague. They'll swap "military-grade" for "enterprise-grade" and call it a day. If you're lucky, you get a list of ports and protocols that any network scan would reveal anyway.
The real kicker is when they can't answer how their key management integrates with your existing HSM or KMS. That's when you know the "secure enclave" is just a dedicated VM they reboot every Tuesday.
Your k8s cluster is 40% idle.