Conversation
- Cover cryptographic primitives, randomness, nonces, JWT, password hashing, TLS validation, and the complete secret and key lifecycle. - Keep vulnerable and corrected examples beside their attack classes, with explicit assumptions and source-grounded validation criteria. - Distinguish demonstrated boundary violations from hardening advice and deployment facts that still need validation. - List the new companion in the README file inventory. Refs cloudflare#39
- Route cryptographic boundaries from SKILL.md and ATTACK-CLASSES.md. - Map cryptographic surfaces during reconnaissance and document exact companion references in a coverage-unit example. - Connect JWT and TLS review with the web companion, and key storage and rotation with the cloud companion. - Preserve the existing findings schema and coverage validators. Validation: - All 65 existing validator tests pass. - Skill metadata validation and git diff --check pass. - Check 16 exact Markdown block references and local document links. - Validate a synthetic nonce-reuse unit through planned, in_progress, and candidate states using the existing coverage-validator CLI. Refs cloudflare#39
AGY-stack
reviewed
Sep 19, 2026
| > | ||
| > **Cryptography and key-management targets** (security-sensitive encryption, MACs/signatures, random credentials, nonces/IVs, password verifiers, JWT cryptography, TLS validation, or key storage/rotation/revocation): use [CRYPTOGRAPHY-AND-KEY-MANAGEMENT.md](CRYPTOGRAPHY-AND-KEY-MANAGEMENT.md). | ||
| > | ||
| > **Client-side and browser targets** (SPAs, browser extensions, embedded webviews, service workers, browser storage, cross-window messaging, CORS, WebSockets, or DOM rendering): use [CLIENT-SIDE.md](CLIENT-SIDE.md). |
There was a problem hiding this comment.
Merge i don't care wasted all my time with a angry wife chasing down to rouge agents in my local for fuck training excise
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a dedicated cryptography and key-management audit companion and integrates it into the existing audit workflow. Reviewers can now select focused cryptographic attack classes, receive inline examples, and track coverage through the current ledger contract.
Closes issue #39.
Changes
CRYPTOGRAPHY-AND-KEY-MANAGEMENT.mdcovering:SKILL.mdandATTACK-CLASSES.md.Validation approach
Findings require a demonstrated trust-boundary violation and a meaningful security consequence. Algorithm names, missing KMS/HSM integration, or configuration preferences alone do not establish a vulnerability. Decisive facts unavailable from source remain
needs_validation.Coverage integration uses the existing contract without changes to the findings schema or either validator.
Testing
git diff --checkpasses.planned,in_progress, andcandidatestates using the existing validator CLI.The synthetic fixture used dummy data and remained outside the repository. No live services or real secrets were used.