Skip to content

Security

The public view is a whitelist, not a filter.

A filter removes what you remembered to remove. A whitelist shows only what you deliberately allowed — so the failure mode of forgetting is silence rather than disclosure.

Threat posture

Assume the edge is hostile.

The Cloud Run service is treated as compromised-in-principle. It receives pushed telemetry and serves projections; it cannot reach into either host, hold execution keys, or originate a trade.

Snapshot files are equally untrusted. Anything read from disk is passed through a whitelist that coerces types and drops path-like values, so a poisoned file cannot introduce fields the API never intended to serve.

anonymous request — public projection

$curl -s https://sapphirealpha.xyz/api/v1/status{  "public_view": true,  "gate": {    "state": "unavailable",    "pause_state": "unknown",    "executor_alive": null  },  "system_health": { "dashboard": "ok" }} # absent by design:#   wallet address, exact balances, caps,#   proposal bodies, file paths, hostnames.

Controls

Six properties, each under test.

Each of these is asserted by the suite rather than documented and hoped for. A regression that leaks a masked address or widens the public payload fails CI.

Default deny
The public projection is a whitelist. A field is invisible to anonymous callers unless it was explicitly listed — so a new field added upstream leaks nothing until someone decides it should.
under test
Signed ingest
Telemetry is HMAC-signed by the collector and verified at the edge. Bodies first pass a bounded duplicate-key-rejecting JSON decoder; the exact raw bytes are then HMAC-verified before acceptance, and replayed sequences are refused.
under test
Address masking
Wallet addresses are reduced to 0xabcd…1234 before serialization. No wallet identifier is exposed anonymously, not even a masked one.
under test
PII stripping
Chat ids, usernames, and anything matching a secret-like key are dropped from proposals and decisions before they reach a response body.
under test
Key custody
Private keys and seed phrases never enter a model context, a log, a repository, or a config file. They stay in OS-level custody and are used only through provisioned paths.
under test
Transport
Machines reach each other over a private mesh, not the open internet. The public edge is the single reachable surface and holds no inbound path to either host.
under test

Hardening

  • Path traversal rejected at middleware, before routing.
  • Rate limits tighten automatically while public read is enabled.
  • CORS defaults to deny; a single origin may be allowed explicitly.
  • nosniff, DENY framing, and a strict referrer policy on every response.
  • Constant-time credential comparison on the operator path.

Disclosure

If you find a vulnerability in anything described here, report it before publishing. Reports are read the same day, and there is no legal threat waiting on the other end of one.

The security model above is a description of intent and current implementation. It is not a warranty, and no system is exhaustively secure.