# Security

> Trust roots, what the CLI refuses, how keys and sessions are handled, and what verification doesn't promise.

Source: https://retoque.xyz/docs/security
Markdown: https://retoque.xyz/docs/md/security

A patch is untrusted input until it passes every check. This page collects what the CLI and the registry do to keep it that way, and what they can't promise.

## Trust roots

- The first-party Retoque publisher key, `c7284ac2fd0b659098d1d7498446b14bba572d2d6e10d96c2e4e20acd41928f1`, is pinned in the CLI source.
- More publisher keys can only be added in `trustedKeys` in your own `~/.config/retoque/config.json`. Nothing the registry sends can add a key.
- The registry is not trusted for integrity. Its digests are cross-checked, and any disagreement is a refusal, but acceptance depends only on the publisher signature and the exact bytes it covers.

## What a package can't do

- **Nothing is executed.** There are no install scripts or hooks. The CLI never calls `pickle` or `torch.load` on package content and never uses `shell=True`.
- **Only safetensors weights are loaded,** with `trust_remote_code=False` for both the tokenizer and the model.
- **Extraction is allowlisted.** Only the eight known file names are written, each as a regular file opened with `O_EXCL` and `O_NOFOLLOW`. Links, devices, absolute paths, `..`, duplicates, unknown names, members over 2 GiB and packages over 4 GiB are refused. `tarfile.extract` is never called.
- **Checks happen before anything moves.** Everything runs in a private staging directory. The install directory, `state.json` and the lockfile are written only after every check passes, and installed files are made read-only.
- **Base weights are read, never written.**

## Registry keys

- Keys start with `rtq_`, are generated server side, and are shown once. Only a keyed hash is stored, so a lost key can't be recovered. Revoke it and create another.
- Each key has scopes: `registry:read`, `artifacts:download`, `installs:report`. A key without the scope a route needs is treated as missing.
- The CLI stores the key in a file with mode `0600` and only sends it over `https`, or plain `http` to `localhost`, `127.0.0.1` or `::1`.
- The key is never sent to the download link. A download link is its own single-use credential and expires after five minutes.
- The key can't call a model and isn't a model provider key.

## Accounts and sessions

- Sign-in uses one-time email links that expire after 15 minutes. Tokens are stored as HMAC-SHA256 hashes, not in plain text.
- Sessions last 30 days in an `HttpOnly`, `SameSite=Lax` cookie, marked `Secure` when the site runs on `https`.
- Linking a wallet needs a signature over a message that binds the site, the chain ID, the address, a nonce and a 10-minute expiry. Each nonce works once. A wallet can be linked to only one account per chain.
- Every state change in the workspace writes an audit record.

## Datasets

Creator uploads are scanned before they are stored. Files with what look like secrets, such as AWS access keys, private key blocks, `sk-` style API keys and JSON Web Tokens, are rejected outright. Likely personal data, such as email addresses, phone numbers, valid IBANs and card numbers that pass a Luhn check, needs an explicit acknowledgement. Findings are shown masked. Datasets are kept in private storage outside the web root. See [Creator guide](https://retoque.xyz/docs/creators#upload-checks).

## Serving

If you serve a patch with vLLM, load adapters statically and keep dynamic LoRA endpoints off. See [Serving with vLLM](https://retoque.xyz/docs/vllm#never-expose-dynamic-lora-endpoints).

## What verification doesn't promise

- It proves who published a package and that you have the exact bytes they signed. It says nothing about output quality.
- Downloaded weights can't be recalled. Revoking a listing or a license stops new downloads. Copies already on disk keep working.
- `--experimental-override` installs outside the tested envelope. Expect anything.
- The license contracts haven't had an independent security review yet, which is why they aren't on mainnet.

## Reporting a problem

A dedicated security contact is planned and not published yet. If you find a vulnerability in the CLI, the registry or the contracts, don't post the details publicly. Operators can withdraw a version and suspend entitlements while a problem is investigated.