mirror of
https://github.com/PR0M3TH3AN/bitgate.git
synced 2026-10-27 08:31:00 +00:00
3 lines
1008 B
JSON
3 lines
1008 B
JSON
{"kind":"constraint","subject":"security/fails-closed-verification","summary":"Administrative state (roles, policy, contributions) is rejected without a configured verifySignature; verification runs inside public ingestEvent, async verifiers on the sync path count as unverified, and trustUnsignedEvents/verify=off are development-only escape hatches made deliberately visible.","status":"active","evidence":[{"type":"repository","ref":"docs/security.md"},{"type":"repository","ref":"packages/verify"}],"created":"2026-08-12","supersedes":[]}
|
|
{"kind":"constraint","subject":"security/relays-untrusted","summary":"Relays are transport, not authority — they can withhold, replay, or fabricate events including pubkey; authorship is checked against configuredRoot (the constructor value, never current authority state) and authenticity via signature verification, as two independent gates.","status":"active","evidence":[{"type":"repository","ref":"docs/security.md"}],"created":"2026-08-12","supersedes":[]}
|