disclosure · scope · posture
Security
Covenant governs agents that hold keys and move value, so its security model is the product, not a footnote. The source is Apache-2.0 and public, every privileged action is hash-chained into a signed audit, and audit roots are anchored on-chain where anyone can verify them. The point is that you never have to take our word for it.
report a vulnerability
Email contact@opencovenant.org with a description and reproduction steps. For sensitive reports, encrypt to the PGP public key published in the repository at SECURITY-PGP-PUBLIC.asc. Please give us a reasonable window to ship a fix before public disclosure. We do not pursue researchers acting in good faith.
in scope
- The Covenant daemon (covenantd): intent dispatch, the permissions and capability engine, memory, and the IPC and HTTP gateways.
- The Solana programs: settlement and staking, and the on-chain attestation and identity records.
- The hosted trust MCP at mcp.opencovenant.org and the sandbox at sandbox.opencovenant.org.
- Signature verification, canonicalization, and anything that could forge or replay a receipt.
Out of scope: findings that require a compromised host or a leaked operator key, volumetric denial of service, and issues in third-party services Covenant integrates with rather than operates.
posture · verify it as a property
A reckless action is refused before it reaches a wallet, a malicious signature is rejected before it is signed, and every permitted action settles with a receipt anyone can check. The mechanics are documented: runtime sandbox and gateway, the hash-chained audit, audit integrity, and the capability model.
Covenant is open source under Apache-2.0. There is no formal bug-bounty program at this time; we acknowledge reporters who ask to be credited.