This repository contains an open-source reference implementation with real Ed25519 signatures, AES-256-GCM payload encryption, Shamir Secret Sharing, witness quorum checks, and audit hashing. Please treat it as reviewable protocol infrastructure, not as independently audited production software.
Please report suspected vulnerabilities privately by email:
contact@agentflow-enterprise.com
Include:
- affected file, schema, or protocol section
- attack scenario
- impact assessment
- reproduction steps or proof sketch
- suggested mitigation, if available
Reports are especially welcome for:
- Ed25519 signing and verification domain separation
- Shamir reconstruction correctness and malformed share handling
- AES-GCM AAD and payload hash handling
- key rotation and recovery
- registry witness identity management
- threshold reconstruction governance
- audit-chain replay or equivocation attacks
The maintainer will make a reasonable effort to acknowledge reports, triage impact, and publish fixes or documentation updates before public disclosure.