Security Policy

This document outlines responsible disclosure practices, project security scopes, and hardening details for ChronoSeal.

Reporting Vulnerabilities

Please do not disclose security vulnerabilities publicly before coordinate disclosure. If you identify a potential security issue in ChronoSeal, contact the maintainers privately.

When reporting, please include the following details to assist our review:

• Detailed description of the issue and potential impact.
• Step-by-step reproduction guide or proof-of-concept (PoC) script.
• Affected versions of the daemon, WASM package, or shared components.
• Any proposed mitigations or code patches.

Project Scope

ChronoSeal operates as a cost-raising security layer, specifically:

• Anti-scraper middleware: Restricts low-resource, simple command-line scripts and scrapers.
• Behavioral attestation layer: Asserts basic input sanity signals.
• Cryptographic continuity verifier: Guarantees that heartbeats progress chronologically along a server-controlled path.

We actively harden the following boundaries and welcome reports regarding:

• Bypassing the hash-chain sequence without having session secrets.
• Replaying previously accepted heartbeat requests.
• Causing server panics, database memory leaks, or execution exhaustion.
• Bypassing stateful synthetic gene mutations.
• Security response header bypasses or CSP evasion.

Hardened Security Features (v1.0.2)

The latest version includes the following security hardening implementations:

• Sanitized Fingerprints: Strict validation of aspect ratio, DPR, and CPU concurrency limits to reject malformed inputs.
• Stack-Depth Protection: Bounded stack limits (capped at 512) to prevent VM buffer overflows.
• DashMap Rate Limiter: Hardened concurrent rate limiting to mitigate denial-of-service attempts.
• Response Headers: Automatic inject of Content-Security-Policy (CSP), X-Frame-Options, and Referrer-Policy headers to secure browser pages.