From f4b7cdc2b6712ade3fa36f4eae01a9fd1dbe2842 Mon Sep 17 00:00:00 2001 From: lakshit verma Date: Mon, 24 Aug 2026 00:44:19 +0530 Subject: [PATCH] README: state precisely what verification covers MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The README claimed entries failing verification are never ingested, but only signed tree heads are verified — individual entries are not inclusion-proof-checked against the signed root. Describe the actual trust model (pinned keys, verified STHs, HTTPS transport) instead of overstating it. --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index e2eab20..5ee30ed 100644 --- a/README.md +++ b/README.md @@ -11,7 +11,7 @@ What that buys you in a recon workflow: - **Continuous coverage.** The tailer runs 24/7 with crash-safe resume. A certificate issued thirty seconds ago is already searchable. Point-in-time tools only see what third parties had indexed when you ran them. - **First-seen timelines.** Every name carries the earliest date it appeared in any watched log (`&dates=1`). Diff over time to catch new subdomains on targets between engagements. - **No keys, no quotas.** Zero API keys, zero third-party terms of service. Your only dependencies are the log lists themselves. -- **Verified provenance.** Each log's signing key is pinned, signed tree heads are verified, and entries failing verification are never ingested. +- **Verified provenance.** Each log's signing key is pinned against the log list, and every signed tree head is cryptographically verified before the tailer acts on it. Entries themselves are not individually inclusion-proof-checked against the signed root: ingestion trusts the verified STH plus HTTPS to the log endpoint. - **Historical drains.** Years of history from retired and rejected logs can be backfilled locally — terabytes if you want all of it. - **A hosted API, not just a CLI.** Pipe results straight into your existing tooling: `curl "http://localhost:8099/v1/search?apex=target.com"`.