SECURITY.md

# Security

## The published trial key

`PUBLIC_TRIAL_API_KEY` ships inside the package. It is published, not secret. Anyone who installs the wheel can read it, so it is scoped, rate limited, and revocable, and it carries no customer data access.

No SDK can hide a credential from the machine it runs on. If the code can send a key to AffixIO, the user can read it. Treat any key embedded in a distributed package as public, and keep production keys in the runtime secret store.

## Trial allowance

The 100 proof allowance is enforced on `api.affix-io.com` against a subject digest. The local file under `~/.cache/affix-huggingface/` holds install credentials only. Deleting it forces re-registration against the same server-side counter rather than granting new proofs.

Local counters cannot be made tamper proof. Anything written to a user's disk can be deleted, and a fresh container or virtual machine always looks new. Server-side counting is what makes the limit hold.

Creating a second identity still yields a second allowance. New subject registrations are throttled per origin. Where the limit must resist deliberate evasion, bind registration to a verified Hub account.

## Credentials

Load `AFFIX_API_KEY` and `HF_TOKEN` from the runtime secret store. Do not put either value in source control, container images, notebooks, model cards, or Hugging Face Spaces variables marked public.

The SDK sends the AffixIO key only to the configured AffixIO base URL and the Hugging Face token only through `huggingface_hub`.

Changing `affix_base_url` transfers the AffixIO key to that host. Treat this setting as security-sensitive and keep the default in production unless you operate the destination.

## Data boundary

The SDK does not include prompt or output content in AffixIO prove, gate, or attestation requests. Model identifiers, declared revision metadata, gate receipts, proof digests, model-binding digests, and the trial subject digest are sent to AffixIO. The Hugging Face account name and token are not.

Customer applications are responsible for calculating `AdmissionChecks` from trusted records. Supplying `True` values without evaluating those records weakens admission to a caller assertion.

## Reporting

Report suspected vulnerabilities privately to security@affix-io.com. Include the affected version and a minimal reproduction. Do not include production API keys, Hugging Face tokens, prompts, or customer data.