Current release status
Public document hashing and exact integer aggregation are live with signed results. Native consensus, mining, issuance, COMPUTE payments and rewards are inactive. Independent operation is not yet demonstrated.
No funded bounty offer
No paid bug-bounty or reward promise is established here. Qualification and research participation are voluntary.
Report safely
For non-sensitive bugs use the official project repository. For a security-sensitive issue, first request an appropriate private reporting channel from its maintainers; do not disclose secrets, exploit live production or post private keys publicly.
Trust boundaries and practical checks
Security comes from specific controls and explicit assumptions. No website badge, AI review or internal test count is an independent security audit.
| Boundary | Implementation / evidence | Meaning |
|---|---|---|
| Browser boundary | Same-origin HTTPS / fixed upstream routes | No caller-selected upstream or server-side wallet signing |
| Evidence boundary | Pinned policy / canonical commitments / Ed25519 | Reject altered, duplicate, unknown or mismatched attestations |
| Execution boundary | Fixed source, bounded input/runtime, non-root isolation | No arbitrary uploaded program or privileged host command |
| Economic boundary | Production activation remains gated | A receipt cannot authorize issuance, payments or governance |
Practical procedure
- 1Verify software/policy provenance through an independently trusted channel.
- 2Keep private identities local with restricted permissions.
- 3Retain authentic evidence and classify the scope of each successful check.
- 4Stop on source/state/runtime mismatches; never replace a failed check with a simulated success.
Technical reference · scope is explicit
Read-only source and pinned artifacts ├─ HTTPS public API / bounded inputs ├─ qualified fixed-source runtime ├─ known-policy receipt verification └─ separate financial/consensus activation gate
Limits and failure cases
- Signatures do not prove independent administration or arbitrary computation correctness.
- Internal tests are scoped evidence; they are not an external audit or economic-security guarantee.
- No certified SOC/ISO/GDPR service or paid bounty commitment is claimed.