What Datamorpho aims to protect
- controlled disclosure of hidden states
- clear separation between public declaration and private reconstruction
- state-specific reconstruction semantics
- attack-cost increase through structure and layout strategy
Security
Security boundaries, review, and responsible reporting
Datamorpho is a security-oriented protocol project, but it does not claim magical invulnerability. This page explains what the project is trying to protect, what remains out of scope, and how to report issues responsibly.
What it does not claim
- not impossible to break
- not a substitute for sound cryptography
- not a defense against compromised endpoints
- not a guarantee against poor operational security
What matters most in practice
- correct cryptographic implementation
- correct reconstruction-object handling
- careful key-material protection
- clear validation and error handling
Demo tooling privacy
The public create and reconstruct tools run entirely in the browser. Files are read locally, processed with the browser’s own Web Crypto implementation, and never uploaded. Datamorpho.io does not receive, store, or log your files, your file hashes, or your reconstruction objects, because they never leave your device. Nothing is transmitted to the server at any point in either tool.
When to use public issues
Use public GitHub issues or discussions for non-sensitive problems such as wording errors, specification clarity problems, implementation bugs without security sensitivity, documentation fixes, and example inconsistencies.
When to report privately
Report potentially sensitive issues privately by email when public disclosure would create meaningful risk, such as exploitable implementation flaws, unsafe reconstruction handling, or severe cryptographic misuse in live tooling.
Responsible reporting address
For security-sensitive reports, contact g@evvm.org. Include a clear description of the issue, affected component, reproduction steps if possible, and why you believe the issue should be handled privately first.
Demo tooling privacy
The public create and reconstruct tools run entirely in the browser. Files are read locally, processed with the browser’s own Web Crypto implementation, and never uploaded. Datamorpho.io does not receive, store, or log your files, your file hashes, or your reconstruction objects, because they never leave your device. Nothing is transmitted to the server at any point in either tool.
Areas especially worth reviewing
- carrier profile parsing and validation
- digest cross-binding behavior
- reconstruction-object interpretation
- key-material serialization and handling
- sparse and sparse-with-chaff reconstruction semantics
- browser-compatible tooling limitations
Project security posture
Datamorpho should be understood as a layered resistance architecture. It is strongest when the protocol, tooling, examples, operational handling, and cryptographic decisions are all treated seriously instead of relying on any one mechanism alone.
Important note on the current phase
The project is still in its first public specification and tooling phase. Early implementations should be treated carefully and reviewed critically. Correctness, clear semantics, and public review matter more right now than feature breadth.