security

Security at Originary

Security posture, supported versions, responsible disclosure, and verification boundaries for Originary.

Supported versions

Security fixes are applied to the current stable release. Older releases do not receive patches.

  • PEAC v0.16.3 (current) — supported; security fixes applied.
  • Earlier releases — not supported; upgrade to the current release.
  • Runtime — Node.js 22.13.0 or newer (required for stable Ed25519 in Web Crypto).

See the changelog for release history and current status.

Severity and response

Reported issues are triaged by impact. Fix timelines are set at triage and communicated to the reporter; the acknowledgment targets below apply to all severities.

  • Critical (signature or verification bypass, key exposure) — acknowledged within 5 business days; prioritized immediately at triage.
  • High (integrity or confidentiality impact on a supported path) — acknowledged within 5 business days; scheduled promptly.
  • Medium and Low (limited or edge-case impact) — acknowledged within 5 business days; addressed in a subsequent release.

Verification architecture

Verification is offline by design. Signed records use Ed25519 (RFC 8032) and compact JWS (RFC 7515). Verifiers need only a public key you supply. The supported path is strict offline verification (record plus a supplied public key or JWKS, zero network). Originary does not publish an issuer key for its own domain and performs no key resolution on your behalf.

Key management

Signing keys are Ed25519. The self-hosting issuer generates and holds its own keys; key custody, rotation, and revocation are the issuer's responsibility. Originary does not run signing, key custody, or key resolution as a hosted or managed service today.

Dependency and supply-chain posture

PEAC Protocol and its packages are open source; their security and publishing posture are maintained in the public repository at github.com/peacprotocol/peac.

  • Packages are published to npm with OIDC trusted publishing and SLSA build provenance.
  • Releases are tagged with SSH-signed annotated tags reachable from the public history.
  • Dependency advisories are tracked in the open repository; the build fails on unresolved high-severity advisories in production paths.

Originary does not run signing, verification, key custody, or record storage as a hosted service today.

Data boundaries

The examples on this site use selected facts and digests rather than raw request payloads. The documented supplied-key CLI flow runs locally, and the /verify page does not accept record uploads. Supplied-key verification runs offline and does not depend on Originary being online.

Network posture

The supplied-key verification path performs no network fetch and does not dereference URLs carried in the record. URL fields in records are locator hints. The PEAC reference implementation, including its MCP server, is open source; its security posture is documented in the public PEAC repository.

Responsible disclosure

We appreciate responsible disclosure. Email security@originary.xyz or contact@originary.xyz with details and reproduction steps.

Our commitment

  • We'll acknowledge within 5 business days
  • Keep you updated on our progress
  • Provide public credit where possible
  • Work with you on responsible disclosure timing

Guidelines

  • Please avoid testing against other users' accounts
  • Respect rate limits and don't cause service disruption
  • Don't access or modify data that isn't yours
  • Report vulnerabilities as soon as you discover them

Scope

This policy covers:

  • originary.xyz and its subdomains
  • The CLI, packages, and code samples Originary publishes
  • Infrastructure directly under Originary's control

Originary runs no hosted signing, verification, key-custody, or record-storage service; those run in the issuer's or verifier's own environment.

What to include

  • Detailed description of the vulnerability
  • Steps to reproduce the issue
  • Potential impact assessment
  • Any proof-of-concept code (if applicable)
  • Your preferred method of communication

Bounty program

No formal bounty program at this time. We do provide public credit and our sincere gratitude for responsible disclosure.

Acknowledgments

Reporters who follow this policy and agree to be named are credited here.

Legal

We will not pursue legal action against researchers who:

  • Follow this responsible disclosure policy
  • Act in good faith
  • Don't violate privacy or cause harm
  • Don't access or modify data beyond what's necessary for testing