Writing
Security
Attack classes, advisories, and what a verifier can and cannot conclude.
Treeship 0.31.2: sealed packages now verify their signatures
package verify checked the Merkle tree and nothing under it. It now verifies every artifact's Ed25519 envelope, session close seals unchained work, and the MCP bridge reports failures.
Treeship 0.19: the security-hardening release
Two adversarial audits, every confirmed finding in the default binary fixed with a regression test, and a receipt export any Ed25519 library can verify.
Treeship 0.10.4: the audit hardening release
A keystore that claimed AES-GCM but was not, verifiers that trusted embedded keys, and a Merkle downgrade path. 0.10.3 and 0.10.4 close the audit findings and publish TS-2026-001.
The Replay Attack Your Authorization System Doesn't Prevent
Most authorization systems for AI agents share a subtle flaw: approvals can be reused. An agent that captures an approval token can replay it. Here's the attack and how approval-based authorization prevents it by construction.
Approval Nonces and Why a Single Field Prevents an Entire Attack Class
The approvalNonce field in Treeship's ActionStatement is doing a lot of work. Here's the full attack class it prevents and why the design is correct.