KODE Labs Trust Center

KODE Labs has successfully completed its annual SOC 2 Type II examination for the period August 16, 2025 to August 15, 2026. The audit was performed by an independent CPA firm in accordance with AICPA attestation standards and resulted in an unqualified opinion with no exceptions noted across all controls tested.

The examination covered the AICPA Trust Services Criteria for Security, Availability, and Confidentiality. A Type II report tests whether controls operate effectively over a sustained period, not just whether they are designed correctly. A result with zero exceptions means every control tested worked as intended throughout the full twelve-month audit window.

This is our second consecutive SOC 2 Type II report, following the one on 2025, and reflects our continued investment in protecting our customers’ data and the KODE OS platform.

Access the report
Customers and prospects can request the full report through the KODE Labs Trust Center. An NDA will be required.

For questions, contact your account manager or security@kodelabs.com.

KODE Labs Security Team

Security Update: Node.js Brotli Decompression Vulnerability

Status: No impact to KODE Labs customers · Mitigated · No customer action required

KODE Labs has completed its assessment of CVE-2026-111497, a vulnerability in the Brotli decompression library used by Node.js. No customer data or services were impacted.

• Mitigated: One internet-facing API service required a precautionary mitigation, which was applied within hours of disclosure and covered all tenants.
• Not affected: All other services are either not reachable from the internet or do not decompress Brotli input.

Our completed assessment included:

• A full review of all Node.js workloads across production environments.
• A full review of edge and request logs for exploitation attempts.
• An end-to-end test of the mitigation and its alerting on October 26.

We found no evidence of exploitation in our environment.

The following security protections are in place:

• Edge protections at Cloudflare and our cloud boundary block Brotli-encoded requests before they reach the affected service.
• Active alerts monitor every blocked attempt. The only alert recorded so far was triggered by our own validation test.
• As an additional precaution, all Node.js workloads are scheduled to move to a patched runtime in the next release window, before November 10. Existing edge protections will remain in place until the update is complete.

No customer action is required. We will update this notice when the runtime update is complete.

Further information: Node.js security advisory · CISA Known Exploited Vulnerabilities Catalog
Questions: security@kodelabs.com
KODE Labs Cyber Security Team

Security Update: PHP Vulnerabilities and TiDB Cloud Incident

Status: No impact to KODE Labs · No customer action required

KODE Labs has completed its assessment of the following security developments. No production services are impacted.

• PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619): These critical vulnerabilities can allow unauthenticated remote code execution on affected PHP systems. KODE does not use PHP in our production platform or any customer-facing service.
• TiDB Cloud incident: KODE does not use TiDB or PingCAP services and is not impacted by the reported incident.

Our completed assessment included:

• A full scan of all running services.
• A full review of logs for exploitation attempts.
• A full scan of our code.

We found no evidence of exploitation in our environment.

Existing security protections remain active, with the following layers of mitigation already enabled in our security stack:

• Edge protections designed to block exploitation attempts.
• Runtime controls configured to automatically terminate compromised services.
• Active alerts for detected exploitation activity.

No customer action is required. We will update this notice if our assessment changes.

Further information: PHP security advisory · Cloudflare advisory
Questions: security@kodelabs.com
KODE Labs Cyber Security Team

We are proud to announce that, as of September 23, 2025, KODE Labs has successfully achieved SOC 2 Type II certification. This milestone reaffirms our ongoing commitment to maintaining the highest standards of security, availability, and confidentiality, ensuring that our clients’ data is protected with rigor and transparency.

This independent audit, conducted by an AICPA-accredited third party, validates that our internal controls and security practices are designed and operating effectively over time to protect our clients’ data.

Our SOC 2 Type II certification builds upon our previous Type I report and demonstrates our continuous investment in maintaining a secure, reliable, and compliant environment.

You can access our latest SOC 2 report and learn more about our security posture through our Trust Center.

KODE Labs Security Team