Start the Device Security Check, Person Checklist, Security Knowledge Quiz, and Policy acknowledgement.
Sign in with the Google account you use for Redwood work to run the Device Security Check, complete your Person Checklist, take the Security Knowledge Quiz, and submit the Security Policy acknowledgement form.
Normal email sign-in
If you don't have a Google Workspace or Gmail account associated with yourself on the Redwood Roster (you can message your sponsor, project lead, or manager to find out what email address is associated with you on the Redwood Roster), you can use the normal email sign-in below. It will send a one-time code to your email so you can sign in.
Nothing is submitted until you review the exact report and consent.
This service stores AL2 operational security evidence. It never collects secret values, file contents, browser contents, or raw shell history.
Your setup
Security status
This email is not registered
Security Setup did not find this signed-in email on Roster. Use the address associated with your Redwood work, or ask your sponsor, manager, or project lead to confirm it is on Roster and which address to use.
You can continue provisionally. This cannot grant access or change your Redwood access level. If that email is later added to Roster, these submissions attach to that person the next time they sign in. Until then, DevOps can see them as orphaned on the dashboard.
This includes writing or running code, using command-line or cloud tools, working on a remote devbox, deploying a website or service, or using a coding agent such as Cursor, Claude Code, or Codex. If you are unsure, choose No. When in doubt, treat your work as non-engineering.
✓
Your account and device requirements
From the Roster
How this stays current
The Security Policy is the source of truth for the Person Checklist, Security Knowledge Quiz, Device Security Check, and Security Policy acknowledgement form. After you finish the Person Checklist and quiz, new or updated items are not required immediately. They are included in a later quarterly cycle only if something was added or materially changed; if nothing new landed, there is no extra quarterly pass. The Device Security Check for a personal computer used for Redwood work stays every 30 days, and new device checks apply when that next check is due. A recorded skip for a Redwood MacBook, Constellation-issued work laptop, or organization-managed laptop with MDM proof satisfies this section instead. The acknowledgement form is a separate required record. Redwood may still require an immediate update for a critical security issue.
✓
Connect this Device Security Check
Waiting
Checking the short-lived connection from the local Device Security Check Report…
1
Device Security Check
Not completemacOS · Windows · Linux
Personal computers used for Redwood work must run the Device Security Check from this site every 30 days. DevOps will send reminders. Skipping is recorded so DevOps can tell it apart from a missing check.
Constellation Partners using a Constellation-issued work laptop do not need to run the Device Security Check on that laptop.
External Collaborators using a corporate or organization-issued laptop can skip only after uploading proof that the organization’s MDM is running on it.
If you skip for an organization-managed laptop, you may defer screen lock to that MDM. Full-disk encryption and A.3–A.5 still apply.
Planning to get a Redwood MacBook does not skip this. It can take 2–3 weeks or longer to arrive, and we apply the same rule in the meantime: any personal computer used for Redwood work must have a Device Security Check report and keep it current every 30 days.
Confirm this skip. You will not be able to use a personal computer for Redwood work until you add one here. This is stored on your security record, not only in this browser.
Skipped — Redwood-issued MacBook only.
Your personal devices
Each personal computer used for Redwood work needs its own current check. Retire a laptop if you no longer use it for Redwood work; archived laptops do not need a 30-day check and do not count against this setup. If this is your last personal computer, you choose a skip or confirm that you will enroll another one before the archive is saved.
Archived personal devices
These laptops are no longer used for Redwood work. They do not need a 30-day check and do not count against your setup. Restore one, or run a new Device Security Check on that computer, if you start using it again.
This check does not permanently install anything to watch this computer, and it does not leave a background program running. It only runs while the terminal that started the command is open. It is only for checking and fixing security settings, reading machine metadata, and sending a report after you review it so Redwood can record that this device meets policy.
If you use a personal computer for Redwood work, run the Device Security Check on that computer. A Redwood-issued MacBook does not use this section.
You do not need to know the command line: choose your operating system and follow the steps below.
Open Terminal.On a Mac, press Command–Space, type Terminal, then press Return.
Copy and run this command. Click Copy, paste it into that window, then press Enter.
redwood-security
Run this from an administrator account on the computer. If this is the only account, it is usually already an administrator. If you cannot, contact #devops or Marshall Richards and we can walk through alternative steps.
Read the scan, then choose yes only for AUTOMATIC changes. The checker prints each result as ok, FAIL, or Unknown. AUTOMATIC items can be handled by the program itself, but will run only if you type yes. GUIDED items never run from that prompt; finish them on the local review page with auto-detect, a copied agent prompt, or the Settings steps.
Review the local Device Security Check Report. A private, local browser page opens on this computer. Review every field. There are a few items marked GUIDED or UNKNOWN in the terminal ouput that could not be taken care of by the program itself. For these items, you can use either the auto-detect local CLI agents feature, or manually paste a prompt into an agent that has local shell access on your computer, or you can manually adjust the settings yourself following the guides for each item. We recommend using agents these items because the agents can actually in most cases verify these items for you which you will see marked with a "Verified By Agent" tag. After yourself or an agent has made a change click re-scan to have the checker run again. If an item still cannot be confirmed automatically, the local page asks you to choose last-resort human verification or a human override for that item. Human verification means you completed the setting yourself and the checker or agent could not confirm it. A human override is only when you cannot complete the item now because of extreme friction, such as reformatting the disk; that choice requires a note on that item, and you should tell Marshall Richards what you could not get working. You can also look over the exact JSON that will be sent. When the report looks right, choose Prepare report.
Connect your Redwood account and submit. After clicking "Prepare Report" you will need to link the local page to your Redwood account. You do this by clicking "Connect Redwood account" after which a new browser tab will open to security.rdwrs.com where you will need to login, this page will then close after a few seconds of a succesful login at which point you can return to the local page and click "Submit reviewed report" which will send the report to us. If for some reason this does not work you can always download the reviewed report from the local page and submit it manually using the JSON fallback below.
The native checker is a small Go program that reads the listed operating-system settings, shows every result, applies only the AUTOMATIC changes you approve with yes, then opens the private local review page for GUIDED steps and submission. It is not a monitor: closing that terminal stops this run. Agent skills and persistent instructions are already bundled and install only after yes. Persistent Agent Security Instructions are required if you use coding agents for Redwood work; you then choose which optional Redwood skills to install. They are local helper instructions you approved, not a Redwood watcher, and they do not require a GitHub account or clone. Code signing and notarization remain a production-release gate.
This is optional and only for transparency. You do not need it to finish setup. If you want to inspect the program that will run on this computer, download the Device Security Check source. You can review it yourself or with an agent, or compile it locally. This archive is the checker program only; it does not include the policy catalog of what we score. Most people should use the command above. The usual command still downloads a compiled binary.
Returning device or another computer?
Run these same steps again on each personal computer you still use for Redwood work, at least every 30 days. DevOps will remind you when each active personal device is due for its next check. Retire a laptop from this page if you stop using it for Redwood work; archived devices do not need another scan and do not count against your setup. The command safely updates the checker, an installed checker also refreshes itself when opened normally, and an existing computer keeps the same device identity. If the run is interrupted or the computer restarts, run the same command again: completed settings remain in place and the unfinished short-lived submission resumes when possible.
Direct submission unavailable? Use the JSON fallback
Download the reviewed report from the local page, then choose it here. You will preview the exact JSON again before anything is sent.
2
Person Checklist
Not started
These are the requirements software cannot reliably verify for you. They are grouped so you can see exactly what remains. Your in-progress answers stay on this browser until you submit.
Security requirements for engineering work
Your answer adds the relevant security acknowledgments above. It does not require a particular IDE, package manager, or container tool.
Use short-lived CLI authorization and the approved secret path.
Reuse a valid CLI session when one exists. Otherwise use browser SSO, OAuth, or device authorization instead of creating a persistent cloud access key. For new Redwood remote development machines, prefer a scoped workload identity or instance role with AWS Secrets Manager. A .env file may be used only as a temporary solution. Keep 1Password as the source of truth rather than signing a personal 1Password session into the machine. Existing Linode machines will be deprecated and migrated soon. Create new Redwood remote machines with research-devboxes.
Policy A.7 · A.11
Follow Redwood network and hosting boundaries.
Redwood web apps, services, and remote development machines belong behind Tailscale or Cloudflare Access and should be deployed on AWS (the front-end may be on Vercel). Get permission from Marshall Richards before exposing a Redwood web app publicly. Genuinely static AL1 research sites may be shared by link and must use Redwood-org GitHub Pages, Vercel, AWS CloudFront, or Cloudflare. Localhost-only local services do not need a gateway. Any site with AL2 or higher information needs an access gateway.
Policy A.2
Acknowledge every item to submit the Person Checklist.
3
Security Knowledge Quiz
Not started
This Security Knowledge Quiz will test your knowledge of the Security Policy. Questions match whether your Redwood work involves engineering. Question and answer order change on every attempt. 75% or higher passes, and you can retry as often as you want; a later passing score still counts and does not reset your overall setup progress. Until you pass, we only show topic hints rather than the exact questions you missed. After a pass, missed questions and their correct answers are shown so you can learn them. New quiz items after a pass are not required immediately; they wait for a quarterly cycle only if questions were added or changed.
4
Security Policy acknowledgement
Not submitted
This Google Form is a required fourth section. The other three website sections cannot make setup 100% complete by themselves. Use the same email you signed in to this website with. After you submit, keep this tab open or come back to it — the page watches for the form and updates on its own.
Watching for your form submission. This usually updates within a few seconds after you submit.
Security Policy acknowledgement is on file.
Your history
DevOps
Security Posture Dashboard
People—Roster projectionPerson Checklist + quiz + form—Passing peoplePersonal devices—Current within 30 days · no failed checksDevice skips—Redwood MacBook, Constellation, or org MDMNeeds attention—Missing, failed, or out of compliance
Confirmed Device Security Check skips
These people confirmed a recorded skip: Redwood-issued MacBook only, Constellation-issued work laptop, or an organization-issued laptop with MDM proof. This is an explicit skip, not a missing check. Organization MDM skips include a screenshot or PDF you can open here. Adding a personal computer later clears the skip. Clear skip undoes the current skip only. Checklist, quiz, acknowledgement, and device reports stay. MDM proof stays in the audit log.
Audit log
This is the durable record of what happened after a live skip, submission, or device row changes. Each sentence is stored when the action happens, so you can still see that a Redwood MacBook skip existed after it was cleared. Later column or card changes can read stored display hints and details without rewriting those sentences. CloudWatch operational logs stay separate.
Orphaned submissions
These came from a signed-in email that was not on Roster at the time, or from an acknowledgement form email that did not match Roster. They stay stored. If that email is later added to a Roster row, they attach to that person the next time they sign in or the form sheet syncs.
People and completion
Name is the Roster display name. A person passes only with a complete Person Checklist, a passing Security Knowledge Quiz, and a recorded Security Policy acknowledgement form. Completed is the date the last of those three was finished. Person Checklist and quiz use the stored submission time; the form uses the Google Form timestamp when it is present. Mark passed records those three after a DevOps admin confirms the person finished them. Wipe submissions permanently deletes that person's Person Checklist and knowledge-check attempts so they can submit again. The acknowledgement form record stays unless it was never received. Device reports are not affected. Clear skip on a person undoes only their Device Security Check skip. A Device Security Check skip is an explicit confirmation, not a missing report. Person Checklist and quiz additions do not reopen a recorded pass; leftover prompts stay off until an org-wide quarterly cycle.
Device reports
A person may retire a personal laptop they no longer use for Redwood work. Retire keeps stored reports but stops that device from counting as current or receiving 30-day reminders. Delete permanently removes that device and every stored report for it. Person Checklist and quiz records are not affected.
Quiz and Person Checklist attempts
Delete removes one stored attempt. Wipe submissions on a person removes every checklist and quiz record for them.