data access
- Traffic. slash0 has no component in the traffic path. Packets flow from your security groups to the vendor directly.
- Credentials. The hosted tier works through an AWS RAM share that you accept. slash0 holds no role, no keys, and no access to your resources.
- Consumer metadata. AWS shows a prefix-list owner two things about consumers: the account IDs that accepted the share, and the security group IDs that reference each list. Rule contents are not visible. This metadata is used for one purpose: a share is not revoked while any consumer security group still references a shared list.
what you are trusting
The trusted artifact is the contents of the lists. The controls around it: the pipeline that builds them is open source. Every range traces to the vendor's official publication with a recorded URL, timestamp, and content hash. Ranges are never widened beyond what the vendor published. Every publish is signed.
verify the signature
The feed index carries a detached ECDSA P-256 signature in
index.json.sig, format keyid:base64. The signing key is
held in AWS KMS and cannot be exported. The public key (keyid
9823e091) is published here, in the
feed README, and pinned
in the hosted tier's verifier. The format carries a key id and consumers pin a key
set, so keys rotate without breaking verification.
# the public key cat > slash0.pem <<'EOF' -----BEGIN PUBLIC KEY----- MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEqevHf1FrgbrKV5zzV+C1yjoOvi11 k2+y5sDFwSpNqhuS1yeJaBFSVUFYCc39pqlNST+vR/Jd4DMwfjjkVWovTQ== -----END PUBLIC KEY----- EOF # fetch the index and its signature curl -s https://feed.slash0.io/v1/index.json -o index.json curl -s https://feed.slash0.io/v1/index.json.sig | cut -d: -f2 \ | openssl base64 -d -A > index.sig # verify openssl dgst -sha256 -verify slash0.pem -signature index.sig index.json # prints: Verified OK
Service documents are covered through the index, which records each document's SHA-256:
# the hash recorded in the signed index grep -A2 '"slug": "stripe"' index.json | grep sha256 # the hash of the served document; the two must match curl -s https://feed.slash0.io/v1/services/stripe.json | shasum -a 256
threat model
- Covered: tampering between the build and the consumer (CDN, cache, or network path). The signature and hash chain fail closed. The hosted tier's reconciler rejects unverified data and keeps serving the last-good lists.
- Covered: malformed vendor data and bad publishes. See the safeguards section of how it works.
reporting
Report vulnerabilities privately through GitHub security advisories, also listed in security.txt. Reports of incorrect list contents are treated with the same severity as vulnerability reports.