verification
Security and disclosure
How the verifier works, what it can prove, and how to report a problem.
The public security model
The website verifies certificates against the public register in Aegean-Licensing. The register is the public proof of issuance. A certificate digest proves only that its own contents are consistent; anyone can recompute one. A certificate is evidence of a grant only when its id and digest appear in the register as valid.
The issuer's HMAC signing key is never published, never sent to the browser and never accepted by the verifier. The private signature check lives only in AegeanWorks' operations tooling. A forged certificate cannot pass the register check without a matching entry in the public repository.
What this site does to reduce risk
- Certificates are read in the browser and are never uploaded. There is no certificate POST endpoint.
- The verifier fetches the canonical register, terms registry and cited agreement over HTTPS from the Aegean-Licensing repository.
- Untrusted certificate and README values are rendered as text, never as HTML.
- Links are rebuilt from validated repository names; the atlas does not execute API-provided markup.
- Every page sends a Content Security Policy. Scripts are self-hosted or pinned by SHA-256; forms, objects and base URLs are disabled.
- The published verification order, canonicalization and conformance vector are in licenses/VERIFICATION.md.
Scope and limits
In scope: the static site, its browser verifier, the project atlas, the project dossiers, the public verification specification and the public register publishing flow.
Out of scope: GitHub infrastructure, GitHub account security, email security, social engineering, and denial-of-service through third-party rate limits. The register's integrity rests on the access controls of the GitHub repository; a change to a register entry is visible in the repository history.
Report a vulnerability
Email aegean-licensing@proton.me with the affected URL or repository, a concise description, reproduction steps and the impact you believe is possible. Do not include real license keys, private keys or personal data. Please allow 90 days before public disclosure so a fix can ship.
There is no bug bounty. Reports are acknowledged on a best-effort basis. The supported version is the current main branch of the website repository.