aere-network/aere-node
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add SECURITY.md and AUDITS.md

Browse Source 
Both are prerequisites for any external review programme, and one of them was already
promised by our live security.txt to a file that did not exist.

SECURITY.md states the scope, the response times we hold ourselves to, and three things
we would rather a reviewer heard from us than discovered: there has been no third-party
audit, every validator is operated by the Foundation, and the post-quantum guarantee is
at anchor heights rather than on every block.

AUDITS.md opens by saying we have had no third-party audit, and keeps that first line
until it stops being true.
This commit is contained in:
Aere Network 2026-09-01 11:58:34 +03:00
parent 2b73bcb961
commit 2f6950e44e
2 changed files with 104 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

59
AUDITS.md Normal file
View File

@ -0,0 +1,59 @@
# Security audits and reviews
**AERE Network has had no third-party security audit.** That is the first line of this page on
purpose, and it stays here until it is no longer true. Everything below describes what we have
verified ourselves, which is a weaker thing, and we do not want the difference blurred.
Last updated: 2026-09-01.
---
## External audits
| scope | auditor | date | report |
|---|---|---|---|
| — | none | — | — |
There is nothing to put in this table yet. When there is, the full report goes here, including any
findings we chose not to fix and why.
## What we have done instead, and what it is worth
- **Continuous self-verification.** The chain's live properties are re-measured automatically rather
than asserted in prose: validator set size, quorum, the post-quantum anchor threshold, the base-fee
floor, backup coverage, and the public verifier. A claim that stops being true shows up as a failed
check, not as stale documentation. This is real, and it is still *us checking us*.
- **Negative controls on every gate.** A check that has never been shown to fail is not evidence. For
each safety-relevant check we plant the defect it is supposed to catch and require it to go red,
then restore the source and require it to go green. A check that cannot fail is treated as broken.
- **A reproducibility package prepared for an external reviewer.** The consensus code under review,
a threat model naming the attack surfaces we consider realistic, a pinned reproduce guide, and a
manifest of file hashes. It is ready to hand over.
- **Independent verification by a second implementation.** The post-quantum anchor certificates on
the live chain are validated by a second client, written in a different language on a different
codebase, which reaches its own verdict on every anchor.
**None of that is an audit.** Self-verification finds the mistakes you thought to look for.
## Verify the chain yourself, without trusting us
The post-quantum anchor is designed so you do not have to take our word for it: from block
13,014,000, every 32nd block carries a Falcon-512 certificate, and the block hash covers it. From
block 14,961,456 that certificate requires at least six valid seals out of nine. The verifier is
public, the signatures are in the headers, and the check runs against any node — ours or your own.
## Reporting a vulnerability
Report to **security@aere.network**, or see <https://aere.network/security> for the full policy.
- We aim to acknowledge within 72 hours.
- Public credit on this page unless you ask to remain anonymous.
- We will not pursue legal action against good-faith research conducted under the published policy.
- If a report leads to a fix, the fix and the finding are published here together, including the
window during which the issue was live.
## What this page will never do
It will not describe a self-review as an audit, and it will not report a fix as complete before it
has been verified on the live chain. If you find a claim on this page that you can measure and
disprove, that itself is a valid security report, and we would like to receive it.

45
SECURITY.md Normal file
View File

@ -0,0 +1,45 @@
# Security policy
## Reporting a vulnerability
Report privately to **security@aere.network**. Do not open a public issue for a security problem.
- We aim to acknowledge within **72 hours**.
- We will tell you whether we consider the report in scope, and why, within **7 days**.
- We will not pursue legal action against good-faith research conducted under this policy.
- Public credit on [AUDITS.md](https://aere.network/AUDITS.md) unless you ask to stay anonymous.
The canonical, always-current policy is <https://aere.network/security>, and the machine-readable
pointer is <https://aere.network/.well-known/security.txt>.
## In scope
- Consensus for AERE chain **2800**: the QBFT implementation, the post-quantum anchor certificate,
and the post-quantum layers on consensus messages.
- The post-quantum precompiles (`0x0AE1`–`0x0AE5`) and the code that dispatches to them.
- Node RPC surfaces exposed publicly.
- Solidity contracts deployed by the Foundation.
## Out of scope
- Denial of service by traffic volume against public endpoints.
- Findings that require physical access to Foundation hardware or a Foundation private key.
- Reports generated by automated scanners with no demonstrated impact on this chain.
## What we will tell you honestly
- **There has been no third-party security audit of this project.** See
[AUDITS.md](https://aere.network/AUDITS.md). Everything verified so far is us checking ourselves,
which is weaker, and we do not describe it as an audit.
- **All validators are operated by the Foundation.** The number of independent parties who would
have to agree to halt this chain is one. No amount of cryptography changes that number, and a
report pointing at the consequences of that fact is in scope and welcome.
- **The post-quantum guarantee is at anchor heights**, not on every block: from block 13,014,000,
every 32nd block carries a Falcon-512 certificate under the block hash, requiring at least six
valid seals out of nine from block 14,961,456. Blocks between anchors rest on ECDSA. We correct
over-claims publicly when we find them, and we have done so before.
## Fixes
When a report leads to a fix, we publish the finding, the fix, and the window during which the
issue was live — including anything we chose not to fix, and why.