Policies
Security
Security claims here are evidence-backed: the bar is what can be reproduced from the public repository's test suites and audit material — not what a marketing page asserts.
Reporting a vulnerability
Send reports to [email protected]. Good-faith security research is welcomed. Include:
- The affected component, module or workflow
- Precise reproduction steps
- Expected impact and your severity estimate
- Logs, hashes, screenshots or proof-of-concept material
- Any mitigation you have already validated
Initial acknowledgement target: 48 hours.
Response targets by severity
| Severity | Examples | Initial response |
|---|---|---|
| Critical | Consensus manipulation, unauthorised fund movement, signing-key compromise, complete MFA/VEID bypass | 24 hours |
| High | Privilege escalation, replayable attestation or identity flows, sensitive data disclosure | 7 days |
| Medium | Bounded logic bugs, non-critical authorisation drift, incomplete audit logging | 30 days |
| Low | Defence-in-depth gaps, documentation issues, low-impact hygiene | 90 days |
The evidence behind the claims
The repository maintains a security test matrix — contract, integration and end-to-end suites — plus fail-closed scripts for static analysis, dependency and vulnerability scanning, and secret detection. Audit-backed control areas include crypto envelope validation, MFA-gated identity recovery, consensus result matching, and enclave heartbeat replay protection, each mapped to reproducible test evidence.
External audit evidence — a public summary and the engagement record — is published in the repository. The project deliberately does not claim a standing, blanket audit of every subsystem, and this site makes no certification or accreditation claims. What is claimed is what you can reproduce.
Supply-chain requirements for releases include pinned tool versions, SBOM generation, cosign signing and verification, and provenance generation — documented in the repository's supply-chain security policy.
Your side of the security model
The strongest protocol cannot compensate for a compromised phone or a phished approval. Work through the device security checklist and learn the scam patterns that target identity users.
Read the full policy
The complete security policy, test matrices and audit summaries are in the open-source repository (SECURITY.md).