Security Policy
Coordinated disclosure process and security guidelines for PEAC Protocol.
Security Posture
Cryptography
Ed25519 (RFC 8032) signatures via JWS compact serialization. No embedded keys, no ambient key discovery. JOSE hardening rejects b64:false, zip, crit, and embedded JWKs.
Verification
Offline verification with caller-provided public keys. No implicit network calls during verification. Fail-closed defaults on all validation paths.
Network Safety
SSRF prevention by design: URLs are locator hints only, never implicitly fetched. MCP server binds to localhost only with CORS deny-all, rate limiting, and request size limits.
Supply Chain
OIDC-based npm publishing with provenance attestation. GitHub Actions pinned to full SHA. CodeQL security-extended analysis. Dependency review on all PRs.
For detailed security analysis, see the Security & Evaluation page.
Reporting Security Issues
Please do NOT report security vulnerabilities through public GitHub issues.
For security reports, contact us privately:
What to Include
When reporting security issues, please provide:
Response Timeline
Within 48 hours
Acknowledge receipt of security report
Within 1 week
Initial assessment and severity classification
Coordinated timeline
Work together on fix development and disclosure timeline
Security Best Practices
For Implementations
For Deployments
Security Advisories
Security advisories are published through:
Scope
This security policy covers:
Third-party implementations have their own security policies - please refer to their respective maintainers.