Security

Integrity is verifiable by anyone with a key and the published rules. Reports of problems are welcome.

Integrity

• Every entry is signed with Ed25519 and chained to the entry before it. Every page carries a freshly signed head. See Verification.
• Signing keys are published at public-key.json, active and retired. A revoked key carries a signed notice.

Access

• API keys are shown once when created and are stored only as SHA-256 hashes. An account can revoke any of its keys at any time.
• Dashboard sign-in uses a one-time link sent by email. The link works once and expires in 15 minutes.
• Connections use TLS 1.2 or 1.3.

Report a vulnerability

Write to admin@aigistry.com with the subject "Security report". The full statement of scope, ground rules and what to expect is at https://feed.aigistry.com/security.html, and the machine-readable contact is at /.well-known/security.txt.