SecurityCheck us, don't trust us
Built to be checked.
The signing pages, the keys they pin, and the envelope format are all verifiable from the outside. This page tells you how.
SecurityCheck us, don't trust us
The signing pages, the keys they pin, and the envelope format are all verifiable from the outside. This page tells you how.
§ 01
The code that signs must itself be checkable — a poisoned page is the real attack on browser signing.
Release manifestEvery release publishes manifest.json — the SHA-256 of each file the signing pages are made of, recorded in the tagged release before deploy.Compare what you were servedcurl -s https://bearomark.io/assets/envelope.js | shasum -a 256 — and match it against the manifest entry.The witnessA scheduled job fetches the live pages every few hours, compares them against the latest release's manifest, and alerts us on any drift. It detects a substituted page; it does not prevent one — the record is what lets you and us tell.§ 02
Attestor public keyEmail attestations are signed by Bearocratic's attestor key. Its public half is pinned in every verifier — this site, the app, and the CLI:ed25519:93n8OZw8PLJbd4jNwVKExFZvn9QMprNtIEdqfDpvzLs=No key escrowSigning keys — sender sealing keys and guest passkeys — are created and held on user devices. We cannot sign as anyone.§ 03
Documented and openssl-checkableAn envelope is JSON: document bytes, a frozen SHA-256, and a chain of Ed25519/ES256 signatures each covering everything before it. The format is documented; nothing requires our code to verify.Reference verifierThe bearo CLI ships bearo mark verify, including token-level RFC 3161 timestamp validation.No server dependencyIf bearomark.io disappeared tomorrow, every envelope ever sealed would still verify.§ 04
Signing links deliver envelopes through a relay. What it can and cannot do is a design property, not a promise.
Ciphertext-blindEnvelopes are encrypted in the sender's app before upload, with a key that travels only in the signing link's fragment — never to us. A breach of relay storage yields ciphertext and routing state, not keys. The complete link is the key: whoever carries it can open that delivery.Tamper-evident deliveryThe encryption authenticates the delivery's context, and the signing page re-derives the envelope digest the sender committed to. A relay that swapped or altered bytes produces a loud failure, not a quiet substitution.The relay never judgesSignature validity is decided by the verifiers — this site's pages, the app, the CLI — never by the relay. It stores, carries, and deletes; it holds no signing keys of any kind.Compelled productionFrom relay-held data we can produce: stored ciphertext and coordination state (hashed access tokens, sizes, an envelope digest, the sender's public sending key, lifecycle timestamps); from the credential service, issuance records for that key. None of it contains plaintext, decryption keys, guest accounts, or cleartext identities.The page is part of the trustThe code served at /s decrypts a delivery; the code at /sign reads a file you hold. Both display what you sign — which is exactly why their hashes are recorded in the release manifest and watched by the witness (§ 01).§ 05
Found something?Report vulnerabilities to hello@bearocratic.io. We read everything and respond; please give us reasonable time to fix before public disclosure. No bounty program yet — credit gladly given.