KEYS
Edge verifies, never signs
Only public verification keys are deployed to bidder nodes.
Security· design posture
Assume the document is hostile.
AdBid handles money and personal data. Every boundary is explicit: what crosses it, who authenticates, what is authorized, and what is logged.
01 / THREATS
Who we design against.
The model names attackers and their limits rather than claiming they cannot exist.
| Threat | Boundary tested |
|---|---|
| Malicious creative or page | Untrusted content never becomes instructions or code |
| Stolen agent token | Scoped, expiring, revocable; immediate denial |
| Compromised browser session | Origin, CSRF, session, capability checks |
| Hostile provider payload | Schema validation; no implicit trust in partner data |
| Insider over-reach | Separation of duties; dual control; enhanced recording |
| Ledger desync | Halt new liability on uncertainty |
02 / MONEY
The warrant chain is separate from agent execution.
An agent cannot mint authority. The approving principal is distinct from the requesting principal where thresholds require it.
REVOKE
Low-latency revocation
Short expiries and fail-closed freshness limits back up the revocation channel.
JOURNAL
Double-entry by construction
Every financial event writes balanced legs; corrections are compensating entries.
03 / DATA
Minimize, classify, expire.
Credentials, content, derived excerpts, identifiers, activity, audit metadata, and telemetry each have a purpose, storage location, retention, and exposure path.
Audit events store IDs, digests, status, duration, and redacted error types — not creative copy, page content, or bearer tokens. Configuration is stored separately from secrets.
Encryption at rest leans first on OS and storage controls; application-level encryption requires a real key-management and recovery model.
Disclosure
Report a vulnerability to [email protected]. See security.txt for scope and contact details.
Read the threat model and the claims matrix.
Security claims are tied to tests. Anything not tested is labeled as a target.