Security
Architecture, stated plainly.
This page describes how the system is built and what it refuses to do. It claims no certification, because StoneReason holds none.
Custody
No customer private keys
XRPC does not hold, generate, escrow or recover private keys. There is no key-management surface to compromise because there is no key material to manage.
XRPC signs nothing
There is no signing tool and no automatic custody action anywhere in the product, including on the agent surface. Send accepts bytes you signed and hands them to a chain unaltered, recording that they were not modified.
Payments never touch us
A payer pays your address directly. There is no pooled account, no sweep and no settlement step. XRPC watches a chain it has no ability to write to.
Authorisation
Scoped keys
A key carries its own capabilities, networks, transports and environment, set at creation to the narrowest thing that satisfies what you asked for. Leaving that scope is a 403 that points at the key.
Broadcast — the one capability that spends money — is never granted by self-service onboarding.
Tenant isolation
Every read is scoped by the project the key belongs to, taken from the key rather than from the request. An object in another project is not found rather than forbidden, so identifiers do not leak through the difference between two error codes.
An id supplied in a request that names another project is not echoed back.
Agent authority
The MCP endpoint authenticates before it parses, and derives authority from the real scope of the real key. An instruction injected into a request produces a byte-identical refusal to an honest call.
Of fifteen tools, exactly one can touch a chain. No sampling and no resources are advertised, because a server asking the client's model to work on its behalf is authority flowing the wrong way.
Fail-closed capabilities
A capability is offered on a network only where a qualification artefact records that it was seen to answer there. Missing evidence produces a refusal, not an assumption — including at signup, so a key is never issued for something that cannot work.
Network and transport
- Three open ports: 22, 80 and 443. Nothing else listens on a public interface.
- One process at the edge. Every XRPC listener binds loopback, and exactly one of them is reverse-proxied.
- 80 and 443 accept Cloudflare only at the origin firewall.
- Cloudflare Full (strict) with an Origin CA certificate whose private key was generated on the host and has never left it.
- TLS 1.2 minimum, TLS 1.3 enabled.
- HSTS is deliberately not enabled yet. It is a one-way door: once a browser has seen the header it refuses plaintext for the max-age whatever the origin later sends. It will be enabled when Beta operation has proven stable.
- No public admin surface.
/admin*,/metrics*and/debug*return 404 on every public host — as a rule at the edge, so a future route with one of those names cannot become public by being added. - The gateway's admin interface binds loopback and carries no token. The interface it binds is its protection; proxying it would remove that protection rather than inconvenience it.
Service hardening
Each unit runs unprivileged under systemd with
NoNewPrivileges, ProtectSystem=strict,
ProtectHome, PrivateTmp, PrivateDevices,
MemoryDenyWriteExecute, RestrictSUIDSGID,
LockPersonality, and a ReadWritePaths naming only the
state that unit owns.
Data handling
- Secrets are shown once. The gateway stores a digest of a key, never the secret.
- Checkout link tokens are stored as digests and cannot be recovered from the server. A merchant who loses one revokes the link and mints another.
- Source URLs are never serialised back. A customer-configured provider endpoint often carries a credential in its path, so the field is excluded from responses entirely.
- Webhook deliveries are signed HMAC-SHA256 with non-repeating delivery ids.
- Compliance assessments are bounded in memory and are not part of durable state. It is a workflow record, not an address-intelligence warehouse.
- The status page names no upstream providers. A status page that named them would be telling customers which third party to blame for something XRPC is responsible for.
What StoneReason does not claim
No SOC 2, ISO 27001 or PCI. No certification has been obtained, and none is in progress that could be announced.
No third-party security audit. None has been performed on this build.
No SLA. Nothing in this deployment measures availability.
No high availability. One host. A host failure is an outage, and recovery is a restore from backup.
No continuous archive. The recovery point is the last backup; backups run every six hours.
No point-in-time snapshot across processes. The gateway and the developer surface write independently, so a restore is consistent to the last complete record on each side.
Reporting a vulnerability
Email [email protected].
Include what you did, what you expected and what happened; a
request_id if you have one. Please do not run automated scanning
against the Free Beta deployment — it is a single host, and load testing it is
indistinguishable from attacking it.
There is no bug bounty programme and no formal disclosure timeline. Saying so is more useful than implying one exists.