Writing
#security
Every post tagged security.
Treeship 0.31.2: sealed packages now verify their signatures
package verify checked the Merkle tree and nothing under it. It now verifies every artifact's Ed25519 envelope, session close seals unchained work, and the MCP bridge reports failures.
Treeship 0.19: the security-hardening release
Two adversarial audits, every confirmed finding in the default binary fixed with a regression test, and a receipt export any Ed25519 library can verify.
Treeship 0.10.4: the audit hardening release
A keystore that claimed AES-GCM but was not, verifiers that trusted embedded keys, and a Merkle downgrade path. 0.10.3 and 0.10.4 close the audit findings and publish TS-2026-001.
Every MCP Tool Call Your Agent Makes Right Now Has No Receipt
The Model Context Protocol specification is explicit: tool calls are arbitrary code execution and hosts are responsible for authorization. Most MCP implementations have no answer to this. Here's what closing that gap looks like.
The Replay Attack Your Authorization System Doesn't Prevent
Most authorization systems for AI agents share a subtle flaw: approvals can be reused. An agent that captures an approval token can replay it. Here's the attack and how approval-based authorization prevents it by construction.
From Subprocess to WASM: Eliminating the Subprocess Attack Surface
When your TypeScript SDK spawns a Rust binary, you've introduced a $PATH dependency, a binary substitution attack surface, and an IPC channel. All three go away when you compile to WASM.
Approval Nonces and Why a Single Field Prevents an Entire Attack Class
The approvalNonce field in Treeship's ActionStatement is doing a lot of work. Here's the full attack class it prevents and why the design is correct.