How do I report a vulnerability to AffixIO?
Email hello@affix-io.com and use https://www.affix-io.com/security/. RFC 9116 contact details are in https://www.affix-io.com/.well-known/security.txt.
Security
Report issues. Review how we handle them.
AffixIO publishes a machine-readable security.txt and a clear path for responsible disclosure.
Disclosure
If you find a vulnerability in AffixIO services or published SDKs, email hello@affix-io.com with enough detail to reproduce the issue.
security.txt
Researchers can read our RFC 9116 file at /.well-known/security.txt.
Platform notes
- Verification responses are designed so data_retained stays null on the verify path.
- Production attestation uses ML-DSA-65 (FIPS 204).
- SDK hosts prove locally. AffixIO verifies and attests.
- Transport to the site and API is HTTPS.
Security questions
Disclosure, cryptography, and key handling.
What signature algorithm does AffixIO use in production?
ML-DSA-65 per NIST FIPS 204 for attestation on production sync paths. Classical signatures (ECDSA, EdDSA, RSA) are treated as quantum-vulnerable in public AffixIO materials.
Where is the public attestation key published?
https://www.affix-io.com/.well-known/affix-mldsa65.json when published, and api.affix-io.com well-known endpoints for verification material.
Should API keys appear in client-side code?
No. Keep keys on servers, workers, or secure MCP backends. Never embed keys in browser bundles, public repos, or LLM prompts.