If you discover a security vulnerability, please report it responsibly.

Do not open a public issue.

Contact: security@mucizework.com

• Input Validation
• Signature Verification (ED25519)
• Rate Limiting (planned)
• Authentication (JWT)
• Authorization (RBAC)
• Audit Logging (X-Request-ID)
• Secrets Management
• Dependency Scanning
• Static Analysis
• Supply Chain Verification

• /api/v1/hash/sha256 — SHA-256 data digest generation
• /api/v1/sign/verify — Signature verification against wallet+message

Smart contract uses a single authority (mimar) for administrative operations.

Program Derived Addresses (PDA) are validated with canonical bumps.

All PDA seeds are deterministic and documented.

• All POST endpoints validate required fields
• Missing fields return 422 VALIDATION_FAILED
• Empty/malformed bodies return 400 INVALID_REQUEST

Planned for Sprint-03. Will use token bucket algorithm.

Every request is tagged with X-Request-ID for full audit trail:

• API log
• Audit log
• On-chain transaction
• Build log

• No secrets in source code
• Environment variables for sensitive configuration
• .env files excluded from version control