Threat model

We cannot promise “never hacked.” We can make silent library rewrite, hash bypass, and privilege escalation unacceptable outcomes.

Tampered storage or gateway serving the wrong bytes

Reader hashes fetched bytes against the catalog seal. Mismatch withholds the body. No ‘continue anyway.’

Malicious mod trying to appear canonical

Mods are a separate record with their own hash. add_mod cannot write RootRecord. The reader labels mods and verifies the mod digest, never substitutes it for the root.

Non-curator sealing or mutating seals

seal_root requires the curator signer. There is no update_root_content, set_storage_uri, or unseal instruction. Tests attempt both classes of abuse.

XSS via Markdown or HTML in works or mods

react-markdown + rehype-sanitize. No dangerouslySetInnerHTML on untrusted HTML. Links are http(s)/mailto only.

Leaked demo keypairs committed to git

*.keypair.json and .env* are gitignored. Only .env.example is committed. security:check greps for keypair files.

“Fixup” instructions that change sealed fields

Those instructions do not exist. security:check and program tests fail the build if they appear.

Reader trusting UI badges without re-hash

VerifiedMarkdown re-hashes on render. The verified line is painted only after that check. A green badge is not an input to the renderer.