Security

A narrow, inspectable trust boundary.

The public product performs deterministic processing in the browser. It exposes no model-generation endpoint and never receives an OpenAI API key.

Packet safety

• Imports are limited to 512 KB and validated against the V1 contract.
• Text fields and array counts are bounded before imported content is rendered.
• Content checksums use deterministic JSON canonicalization and SHA-256.
• Approved packets are signed with ECDSA P-256 using a non-extractable device key.
• Imports distinguish Signature valid, Checksum matched, Unsigned, and Modified states.

What the signature proves

A valid signature proves that the packet bytes were signed by the private key corresponding to the displayed fingerprint and have not changed since. Establishing a human identity requires comparing that fingerprint through an independent trusted channel. Cryptography does not prove that supplied evidence is true.

Release provenance

The public repository includes a machine-readable release-claims artifact. GitHub Actions runs the locked validation workflow before GitHub OIDC and Sigstore provenance is attached to that exact artifact.

Codex companion

The local forge treats evidence as untrusted data, uses structured output, disables network and web search, refuses approvals, and runs in a read-only sandbox.

Responsible reporting

Do not include private project evidence in a public issue. Report reproducible security concerns through the repository with only the minimum redacted information needed to investigate.