Report a vulnerability.
Email security@originary.xyz with details and reproduction steps. We acknowledge within 5 business days.
Report a vulnerabilitycoordinated disclosure
- machine-readable
- security.txt
- acknowledged
- within 5 business days
- bounty
- none; public credit and our thanks
Include a description, steps to reproduce, impact, and any proof-of-concept code. We keep you updated and agree disclosure timing with you. We will not pursue legal action against researchers who follow this policy, act in good faith, avoid privacy harm, and access or modify no more data than testing needs.
Fixes go to the current release.
| Version | Status |
|---|---|
| PEAC v0.16.4 | Current. Security fixes applied. |
| Earlier releases | Not supported. Upgrade to the current release. |
| Runtime | Node.js 22.13.0 or newer, required for stable Ed25519 in Web Crypto. |
Release history and status are in the release notes.
Triage by impact.
Every severity is acknowledged within 5 business days. Fix timelines are set at triage and sent to the reporter.
| Severity | Examples | Handling |
|---|---|---|
| Critical | Signature or verification bypass, key exposure | Prioritized immediately at triage. |
| High | Integrity or confidentiality impact on a supported path | Scheduled promptly. |
| Medium and low | Limited or edge-case impact | Addressed in a subsequent release. |
How it is built.
- Verification
- Offline by design. Signed records use Ed25519 (RFC 8032) and compact JWS (RFC 7515). The supported path is strict offline verification: a record plus a supplied public key or JWKS, with no network. Originary publishes no issuer key for its own domain and resolves no keys on your behalf.
- Keys
- The self-hosting issuer generates and holds its own Ed25519 keys; custody, rotation and revocation are the issuer's responsibility. Originary runs no signing, verification, key custody or record storage as a hosted service today.
- Supply chain
- Packages are published to npm with OIDC trusted publishing and SLSA build provenance. Releases carry SSH-signed annotated tags in the public history. Dependency advisories are tracked in the open repository, and the build fails on unresolved high-severity advisories in production paths.
- Network
- The supplied-key verification path performs no network fetch and does not dereference URLs in the record; URL fields are locator hints. The reference implementation, including its MCP server, is open source at github.com/peacprotocol/peac.
- Data
- Examples on this site use selected facts and digests rather than raw request payloads. The documented CLI flow runs locally, and the /verify page does not accept record uploads.
What this policy covers.
In scope
- originary.xyz and its subdomains
- The CLI, packages and code samples Originary publishes
- Infrastructure directly under Originary's control
Acknowledgments
No reports have been credited yet. Reporters who follow this policy and agree to be named will be listed here.
Originary runs no hosted signing, verification, key-custody or record-storage service; those run in the issuer's or verifier's own environment. Trust center · Terms