How do I report a vulnerability to AffixIO?

Email hello@affix-io.com and use https://www.affix-io.com/security-shoutouts/. RFC 9116 contact details are in https://www.affix-io.com/.well-known/security.txt.

What signature algorithm does AffixIO use in production?

ML-DSA-65 per NIST FIPS 204 for attestation on production sync paths. Classical signatures (ECDSA, EdDSA, RSA) are treated as quantum-vulnerable in public AffixIO materials.

Where is the public attestation key published?

https://www.affix-io.com/.well-known/affix-mldsa65.json when published, and api.affix-io.com well-known endpoints for verification material.

Should API keys appear in client-side code?

No. Keep keys on servers, workers, or secure MCP backends. Never embed keys in browser bundles, public repos, or LLM prompts.

Security acknowledgements

Thanking the people who help make AffixIO safer.

Responsible security reports deserve a clear response, a fixed issue, and credit when the researcher wants to be named. This page records remediated findings and the people who helped us improve.

Security report log

We only publish enough detail to acknowledge the issue and the remediation. Researcher names and links are added with permission.

Fixed

OAuth Dynamic Client Registration hardening

A researcher reported that the API exposed unauthenticated OAuth 2.0 Dynamic Client Registration with arbitrary redirect URI registration.

Date8 Oct 2026

Areaapi.affix-io.com

StatusRemediated

AffixIO removed public DCR advertising from OAuth metadata, made client registration require an initial access token, tightened redirect URI acceptance, removed the verification probe client, restarted the API service and verified unauthenticated registration now fails closed.

Researcher credit is pending permission. If the reporter would like to be named, we can add their preferred name, company, website, GitHub, LinkedIn, X, Bluesky or other social profile.

Receive

We read the report, reproduce where possible, and avoid asking for unnecessary personal data.

Fix

We prioritise issues that affect account access, API authorization, proof integrity, payment flows or customer data.

Credit

When the reporter agrees, we add a shoutout after the fix is live and the public wording is safe.

Found something?

Email a clear report with affected URL, steps to reproduce, expected result and actual result.

Send a report