Security model

Built to fail closed

Vestavero treats trust as the product. These are the standing rules of this deployment — each one is enforced in code and covered by the test battery, not aspirational.

Public surface

Read-only public API

The public API is read-only. Version 1 exposes no public write handler of any kind; every mutating method on the hosted surface is refused fail-closed. Commercial key enforcement is configurable and read-scoped.

Verification

Fail-closed verification

The verification engine never substitutes a cached answer for the registry. When the contract record cannot be read, the interface withholds a verification conclusion and says so — a degraded state is shown honestly, never as a fake success.

Vocabulary

Record Verified does not mean Authentic

"Verified" means the record shown matches the registry that holds it. It is never a claim that the physical object is authentic, that every historical statement is correct, or that a contributor cannot make a mistake. This law governs every page, label, and badge the system produces.

Evidence boundaries

Public proof, private evidence

Public pages carry public proof only. Personal names, locations, private evidence files, and financial values are not written to the contract. Wallet addresses are shortened on public surfaces.

Capability boundaries

No writer, no signer, no broadcaster

This deployment carries no contract writer, no signing key, no transaction broadcaster, and no deployer. Its only payment surface hands Square-tokenized card charges to Square: card numbers never reach Vestavero, no payment credential is stored here, and the surface stays disabled unless payments are activated. Write specifications are reserved for future versions and remain disabled in the current API.

Deployment discipline

Deployment authorization controls

Production deployment is disabled by default and gated behind explicit operator authorization. Every deployment target is asserted against the authorized account before anything ships.

Interface law

Emerald means verified — nothing else

The verified green appears only on states emitted by the verification engine. No marketing surface, status light, or decoration may borrow it.

Found something that worries you? Report an issue → Read the developer documentation →