Operational risks

The following risks are part of the current deployment model. They are not claims that the controls eliminate the risk.

Keys, credentials, and configuration

Witness private signing keys, signing bearer tokens, federation tokens, external-provider credentials, admin keys, metrics tokens, WebSocket tokens, and secret-bearing configuration are high-value assets. A host, database, backup, log, or deployment-config compromise can expose them. Restrict access, use high-entropy deployment-specific values, and never publish secret-bearing configuration.

Gateway and storage

A malicious or compromised gateway can omit data, equivocate, expose metadata, or alter its SQLite database. SQLite is persistent operational state, not an automatically tamper-evident security log. Clients must verify attestations and proofs; independent auditors can inspect signed tree-head chains. Use local persistent disk and tested backups, but do not treat a backup as proof of historical honesty.

Network and authentication

The gateway and witness node speak plain HTTP. Internet-facing traffic requires TLS termination at a trusted reverse proxy or load balancer. Witness signing routes should be private or network-restricted. Admin routes need an API key and additional proxy/network restriction; metrics and WebSocket routes are public unless their configured tokens or proxy controls protect them. With no WebSocket token, /ws/events immediately broadcasts each newly reserved digest and timestamp, exposing hash-submission activity to anyone who can reach the route. Trust forwarded client IP headers only behind a trusted proxy.

Outbound requests and SSRF

Federation, Freebird, and external anchors make outbound requests. The hardened client and resolver protect witness, federation, Freebird, and Internet Archive paths. Trillian and DNS currently use unrestricted reqwest, and Ethereum performs URL preflight validation only. A malicious or mistaken destination could therefore reach internal services on those provider paths. Review every outbound URL and treat provider-specific SSRF handling as an operational risk; do not weaken the hardened controls to make an unreviewed topology work.

Availability and abuse

Witnesses, gateways, SQLite disks, Freebird, federation peers, and external anchor providers may be unavailable. Threshold collection can fail or become slow when witnesses are unavailable. Gateway and node IP limits are defense in depth. Freebird is optional; consuming mode rejects reused tokens, while non-consuming mode requires another replay boundary. Freebird does not hide transport metadata.

Threshold and independence

A compromised witness can sign misleading data, and threshold collusion can produce a result accepted by the configured policy. Federation and geographic or jurisdictional diversity can add independent durability, but neither provides BFT consensus, global ordering, or immunity from collusion.