From 2f6950e44e7a7c9cf4aa35a41d1c67973bb383f0 Mon Sep 17 00:00:00 2001 From: Aere Network Date: Tue, 1 Sep 2026 11:58:34 +0300 Subject: [PATCH] Add SECURITY.md and AUDITS.md Both are prerequisites for any external review programme, and one of them was already promised by our live security.txt to a file that did not exist. SECURITY.md states the scope, the response times we hold ourselves to, and three things we would rather a reviewer heard from us than discovered: there has been no third-party audit, every validator is operated by the Foundation, and the post-quantum guarantee is at anchor heights rather than on every block. AUDITS.md opens by saying we have had no third-party audit, and keeps that first line until it stops being true. --- AUDITS.md | 59 +++++++++++++++++++++++++++++++++++++++++++++++++++++ SECURITY.md | 45 ++++++++++++++++++++++++++++++++++++++++ 2 files changed, 104 insertions(+) create mode 100644 AUDITS.md create mode 100644 SECURITY.md diff --git a/AUDITS.md b/AUDITS.md new file mode 100644 index 0000000..09307bc --- /dev/null +++ b/AUDITS.md @@ -0,0 +1,59 @@ +# Security audits and reviews + +**AERE Network has had no third-party security audit.** That is the first line of this page on +purpose, and it stays here until it is no longer true. Everything below describes what we have +verified ourselves, which is a weaker thing, and we do not want the difference blurred. + +Last updated: 2026-09-01. + +--- + +## External audits + +| scope | auditor | date | report | +|---|---|---|---| +| — | none | — | — | + +There is nothing to put in this table yet. When there is, the full report goes here, including any +findings we chose not to fix and why. + +## What we have done instead, and what it is worth + +- **Continuous self-verification.** The chain's live properties are re-measured automatically rather + than asserted in prose: validator set size, quorum, the post-quantum anchor threshold, the base-fee + floor, backup coverage, and the public verifier. A claim that stops being true shows up as a failed + check, not as stale documentation. This is real, and it is still *us checking us*. +- **Negative controls on every gate.** A check that has never been shown to fail is not evidence. For + each safety-relevant check we plant the defect it is supposed to catch and require it to go red, + then restore the source and require it to go green. A check that cannot fail is treated as broken. +- **A reproducibility package prepared for an external reviewer.** The consensus code under review, + a threat model naming the attack surfaces we consider realistic, a pinned reproduce guide, and a + manifest of file hashes. It is ready to hand over. +- **Independent verification by a second implementation.** The post-quantum anchor certificates on + the live chain are validated by a second client, written in a different language on a different + codebase, which reaches its own verdict on every anchor. + +**None of that is an audit.** Self-verification finds the mistakes you thought to look for. + +## Verify the chain yourself, without trusting us + +The post-quantum anchor is designed so you do not have to take our word for it: from block +13,014,000, every 32nd block carries a Falcon-512 certificate, and the block hash covers it. From +block 14,961,456 that certificate requires at least six valid seals out of nine. The verifier is +public, the signatures are in the headers, and the check runs against any node — ours or your own. + +## Reporting a vulnerability + +Report to **security@aere.network**, or see for the full policy. + +- We aim to acknowledge within 72 hours. +- Public credit on this page unless you ask to remain anonymous. +- We will not pursue legal action against good-faith research conducted under the published policy. +- If a report leads to a fix, the fix and the finding are published here together, including the + window during which the issue was live. + +## What this page will never do + +It will not describe a self-review as an audit, and it will not report a fix as complete before it +has been verified on the live chain. If you find a claim on this page that you can measure and +disprove, that itself is a valid security report, and we would like to receive it. diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..edfd2cb --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,45 @@ +# Security policy + +## Reporting a vulnerability + +Report privately to **security@aere.network**. Do not open a public issue for a security problem. + +- We aim to acknowledge within **72 hours**. +- We will tell you whether we consider the report in scope, and why, within **7 days**. +- We will not pursue legal action against good-faith research conducted under this policy. +- Public credit on [AUDITS.md](https://aere.network/AUDITS.md) unless you ask to stay anonymous. + +The canonical, always-current policy is , and the machine-readable +pointer is . + +## In scope + +- Consensus for AERE chain **2800**: the QBFT implementation, the post-quantum anchor certificate, + and the post-quantum layers on consensus messages. +- The post-quantum precompiles (`0x0AE1`–`0x0AE5`) and the code that dispatches to them. +- Node RPC surfaces exposed publicly. +- Solidity contracts deployed by the Foundation. + +## Out of scope + +- Denial of service by traffic volume against public endpoints. +- Findings that require physical access to Foundation hardware or a Foundation private key. +- Reports generated by automated scanners with no demonstrated impact on this chain. + +## What we will tell you honestly + +- **There has been no third-party security audit of this project.** See + [AUDITS.md](https://aere.network/AUDITS.md). Everything verified so far is us checking ourselves, + which is weaker, and we do not describe it as an audit. +- **All validators are operated by the Foundation.** The number of independent parties who would + have to agree to halt this chain is one. No amount of cryptography changes that number, and a + report pointing at the consequences of that fact is in scope and welcome. +- **The post-quantum guarantee is at anchor heights**, not on every block: from block 13,014,000, + every 32nd block carries a Falcon-512 certificate under the block hash, requiring at least six + valid seals out of nine from block 14,961,456. Blocks between anchors rest on ECDSA. We correct + over-claims publicly when we find them, and we have done so before. + +## Fixes + +When a report leads to a fix, we publish the finding, the fix, and the window during which the +issue was live — including anything we chose not to fix, and why.