Skip to content

Repository navigation

Security: tejas-coder28/Reverse-Hackathon

Security

SECURITY.md

Security Policy & Cryptographic Threat Model

Fail-Closed Security Policy

The CooL AI Decision Evidence Platform operates under a strict Fail-Closed Security Guarantee.

If any component of the CooL evidence recording pipeline fails (cryptographic hash generation error, key signature failure, hardware enclave timeout, or invalid parameter input):

  • Evidence creation immediately fails closed (success = false, isCryptographicallyProtected = false).
  • The consuming application MUST NOT present the AI decision as cryptographically protected or verified under any circumstances.
  • The user interface explicitly alerts: "Decision completed — evidence protection failed".

Cryptographic Guarantees & Bounds

What CooL Cryptographic Verification PROVES:

  1. Input State Non-Repudiation: The exact applicant financial parameters were recorded at decision time.
  2. Output State Non-Repudiation: The exact decision outcome (APPROVED, REJECTED, MANUAL_REVIEW) was generated by the specified model ID and version.
  3. Tamper Evidence: Any post-hoc alteration of receipt fields invalidates hybrid Ed25519 & ML-DSA-65 signatures and RFC 6962 Merkle log inclusion proofs.
  4. Privacy Protection: Customer PII is protected via salted SHA-256 state commitments (H(SALT : input || output)), ensuring zero raw PII is stored in evidence receipts.

What CooL Cryptographic Verification DOES NOT PROVE:

  1. Model Accuracy & Bias: CooL does not prove that the underlying credit model made a correct, fair, or unbiased loan decision.
  2. External Data Accuracy: CooL proves what data was evaluated by the model, not whether the applicant lied on their loan application.

Secret Handling & Environment Strategy

  1. Zero Client Secrets: Private signing keys, API credentials, and administrative tokens must NEVER be committed to git or exposed to browser client-side code.
  2. Public Verification Keys Only: Public verification keys (SYSTEM_ED25519_PUBKEY and SYSTEM_MLDSA65_PUBKEY) are embedded in src/cool/sign.ts for offline verification verification only.
  3. Environment Template: All environment configurations are templated in .env.example using variable names only.

Reporting a Security Vulnerability

If you discover a security vulnerability or cryptographic flaw within CooL.ledger:

  1. Please report it privately via email to security@cool-ledger.org or open a confidential issue.
  2. Do not publicly disclose vulnerabilities until a patch or mitigation is available.

There aren't any published security advisories