qodiqa
SpecificationRun a simulation

Secure by default. Open to scrutiny.

How the trust is split, what is addressed, what is not, and how to report a weakness.

  • 3 trust domainsEd25519
  • Refusesby default
  • Offline verificationyour keys
Report a vulnerabilityScope and limits

Trust model

Three keys, three jobs.

Artifact keys sign consent artifacts, log keys sign the transparency log's roots and receipts, and checkpoint keys sign audit checkpoints. They are separate files, so forging one kind of evidence does not forge another.

A verifier is independent only if its keys come from somewhere other than the instance it checks.

  • Artifact keys/.well-known/qodiqa/keys
  • Log keys/.well-known/qodiqa/transparency-keys
  • Checkpoint keys/.well-known/qodiqa/checkpoint-keys

Threat model

Six threats, answered.

Only what the specification and the repositories address. Anything not shipped is under Limits.

  • Forged consent

    How qodiqa responds. Every execution call needs an artifact signed with a gateway Ed25519 key. The signature, the required fields, the 60-second age limit and the binding to the exact method, path and body are checked before any provider is called.

    What stays with you. Who is issued a signing key, and the consent records behind it.

    Protocol, artifact verification

  • Replay

    How qodiqa responds. An artifact works once: its nonce is registered atomically in Redis and a second use answers REPLAY_DETECTED. It also expires after 60 seconds at most.

    What stays with you. Operating Redis, which replay protection depends on.

    Protocol, replay protection

  • A tampered log

    How qodiqa responds. Each audit entry hashes the one before it, and decisions become leaves in a signed Merkle log. A verifier that imports nothing from the gateway rejects a changed field.

    What stays with you. Taking the verification keys from outside the instance.

    Verifier test vectors

  • A compromised operator

    How qodiqa responds. The audit chain is unkeyed, so an operator can rewrite it unless checkpoints are anchored outside the gateway. Opt-in anchors commit each checkpoint to a repository others can clone.

    What stays with you. Turning anchoring on, and a witness you do not control.

    Audit anchoring

  • A malicious provider response

    How qodiqa responds. Provider output is untrusted: it passes the output checks, and the decision is recorded before the answer is released. If the record cannot be written, the answer is withheld.

    What stays with you. What an answer means; output inspection is best effort.

    Enforcement flow

  • Key compromise

    How qodiqa responds. Keys live in three separate domains, rotate and revoke with a recorded lifecycle, and are encrypted at rest. A revoked key stops verifying at once.

    What stays with you. The key-encryption key and your rotation schedule.

    Key management

Keys and evidence

What is kept, and how far it is tested.

Keys

  • Rotation, revocation and expiryverified
  • Three signing-key domains kept apartverified
  • Private keys encrypted at restverified
  • KMS and HSM custody (adapters tested against mocks and emulators)partly verified

Evidence

  • Hash-chained audit trailverified
  • Merkle log and checkpointspartly verified
  • External witnesses and anchorsdisabled by default
  • Offline verificationverified

Statuses are those of the capability matrix on the frameworks pages, quoted as written there.

Verify it yourself

Three commands.

Run them from clones of the public repositories; the first clone is in Quickstart, step 4.

  1. Run the protocol vectors

    In qodiqa-verify
    Terminal
    npm test
    Expected

    The vector checkers, the recorded sessions and the tamper self-tests all print PASS, then all checks passed.

  2. Watch tampering fail

    In qodiqa-verify
    Terminal
    node bin/qodiqa-proof-verify.js --proof examples/proof/proof.tampered.example.json
# exit 1 = INVALID
    Expected

    A verdict of INVALID: one audit-entry field was changed.

  3. Check the anchors repository

    Anywhere
    Terminal
    git clone https://github.com/qodiqa/qodiqa-anchors.git && cd qodiqa-anchors && npm test
    Expected

    A line structure check passed with the number of anchors and files.

Scope and limits

Plainly.

Scope and limits

  • Conformance is a self-assessment. There is no certification body and no certification, and a conformance result is not a statement of regulatory compliance.
  • Only the local Ollama provider has been exercised end to end. The adapters for hosted providers are experimental, verified with simulated transport only.
  • A gateway cannot see traffic that bypasses it: direct access to AI providers must be closed at the network level.
  • A receipt proves the gateway recorded a decision, not that the decision was correct. Verification is circular if keys and anchors come from the same instance.
  • Streaming has a weaker guarantee than a buffered answer: a block found only at the end cannot take back text already sent. Output inspection is optional and best effort.
  • Tenant isolation is enforced by the application; PostgreSQL row-level security is an additional layer, not a hard boundary.
  • The tool gateway covers calls made through the gateway to servers an operator registered. It is not general MCP security, and streamed tool results are not supported.

Release 1.0.0 is the only release so far; fixes go to the default branch and ship in the next release. Framework mappings live on the frameworks pages.

Report a vulnerability

Tell us privately.

Please do not open a public issue for a security problem.

  • GitHub private reporting

    Use Report a vulnerability under the repository's Security tab. Preferred.

    Open the Security tab

  • Email

    For reports that cannot go through GitHub.

    security@qodiqa.com

  • What to include

    What you found, how to reproduce it, the version or commit, and the impact you expect.

    Acknowledgement
    Within 5 working days.
    First assessment
    Within 15 working days.
    Fix or mitigation
    For confirmed issues, with credit in the changelog if you want it.
    Coordinated disclosure
    90 days, shorter or longer by agreement.

    A small team: these windows are targets, not guarantees.

  • Scope of reports

    What a report can cover, and what it cannot.

    In scope
    The gateway source and services, the SDKs and deployment assets, and documentation that overstates what the code does.
    Out of scope
    Findings that require an already-compromised host or operator, and denial of service by volume alone.
    security.txtSecurity policy