witness live · topic 0.0.10503843 · settled through api.testnet.blocky402.com
Steal the encrypted share, the Ledger credential, the payment key and the release step. The secret still opens only inside the one job the owner authorised — and every attempt leaves a receipt nobody can delete.
147
variables a compromised dependency read in the unprotected pipeline. One was the deploy key.
0.001ℏ
paid on Hedera by an attacker holding every credential. Refused at check 4, on the record.
0
secrets the same worm got out of the protected pipeline, across every run.
the problem
A repository secret is in the environment of every step, including the one that runs a dependency's install script.
Nothing records that a secret was read: not who, not which run, not whether it happened at all.
The credential outlives the job. Copied out, it keeps working until a human notices and rotates it.
Short-lived federated identity fixes this where it exists. It does not exist for an Etherscan key or a deployer private key.
The blast radius is the whole pipeline: every job can read what any job can read.
You find out from the chain, not from the pipeline — after the funds move.
76%
of crypto stolen in H1 2026
came from infrastructure and operational compromise, not contract bugs, out of only ~15% of incidents.
~700
npm packages hit by Shai-Hulud 2.0
in November 2025, spawning more than 25,000 malicious repositories from one campaign.
$8.5M
drained by one trojanised extension
published with a key that had been read in CI — a read nobody could prove had happened.
Every figure above is sourced in the repository. These losses are not contract exploits. They are credentials read by something that should never have been able to read them.
the protocol
A repository secret sits in the environment of every step, including a dependency's install script. Nothing records that it was read.
PLAIN SECRET [ EVERY STEP · NO RECORD ]
CItrueGITHUB_REPOSITORYacme/paymentsNODE_VERSION24.3.0AWS_REGIONeu-west-1DEPLOYER_PRIVATE_KEY0x4f3a9c…e21b← read by every stepnpm_config_cache/home/runner/.npmRUNNER_TEMP/home/runner/work/_tempGITHUB_SHAbf02e05406422f91…// 147 variables. one of them ships money.
The runner signs a commitment naming the secret, the environment and the run, and pays the witness with its hash as the transaction memo. The request and the public record are one act.
COMMITMENT [ MEMO ≡ HASH · CONSENSUS ]
402 PAYMENT REQUIREDpayTo 0.0.10455530amount 100000 tinybarmemo 983d552fd431c42ac86b1c0fbd…070c200c│ signed by the runner, not the witness▼TRANSFER SUCCESStx 0.0.7162784@1789242038.784103687memo ≡ commitment ✓
Every decision reaches a Hedera topic before share B is returned. The witness cannot suppress it, and nobody can back-date it. A refusal is as permanent as a release.
PUBLIC RECORD [ HCS · UNSUPPRESSIBLE ]
TYPErefusedSECRET███████████ENVIRONMENT(none declared)RUN██████CHECK4PAID0.001 ℏJWT██████████████SEQUENCE#6// written to consensus BEFORE the answer
what we built
KLAXON does not stop an authorised job using its credential. It makes the first read impossible to do quietly, and names what was read, by which workflow, at which commit. Every panel below is a real fragment of a real run.
Public. Worthless without share B.
01Split
Share A is encrypted under your Ledger Key Ring and committed in public. Share B never leaves the witness. Neither half is worth anything alone.
The memo is the commitment.
02Pay to ask
The runner signs a commitment naming the secret, the environment and the run, and pays on Hedera with its hash as the memo. Asking and going on record are one act.
sub: repo:KaranSinghBisht/klaxon-demo@1366574220:environment:production
GitHub says who is asking. The policy says who may.
03Prove who
The witness checks GitHub's OIDC token against a policy the owner's Ledger anchored on Sepolia. A job the policy does not name gets nothing, whatever else it holds.
check 4 — requested by a job with no environment
paid 0.001 ℏ · project revoked
Written before the answer, to a ledger we do not own.
04Publish first
The decision reaches a Hedera topic before share B is returned. The witness did not write it, so it cannot suppress it. Hedera ordered it, so nobody can back-date it.
the one exception, said out loud
An authorised job can read what it was authorised to receive. That is true of anything that hands a process a working credential. What changes is that the read is no longer free, silent, or deniable.
evidence
fig 0.1 — the baseline
stolenAn ordinary pipeline
The deploy key is an ordinary Actions secret, so a compromised dependency's install script reads it like anything else.
fig 0.2 — protected
releasedThe same pipeline, split
Half the key is public. The deploy job pays, proves who it is, and is served. The worm is still there, and finds nothing.
fig 0.3 — the attempt
refusedEverything stolen, run anyway
Every credential, replayed from a job the attacker controls. The payment settles. The witness reads GitHub's own token and refuses.
The two treasuries use different keys on purpose. With a shared key, an untouched protected balance would prove nothing.
what it is built on, and why
Ledger
Key Ring, on a host with no USB port
The trustchain is enrolled on a physical Nano S Plus. A hosted runner restores it headlessly, with no device attached, and decrypts share A. Only the device can change policy or lift a revocation.
Hedera
x402, settled through Blocky402
The witness is a live x402-gated service. Every release is an HBAR transfer whose memo is the commitment hash, and every decision, refusals included, is published to topic 0.0.10503843.
the part nobody puts on a landing page
One audit record costs the witness 3,206,837 tinybar in consensus fees against 100,000 of revenue: a 32× loss per release, measured off the mirror node. The record spans three messages because it carries the runner's whole OIDC token, so anyone can verify it without asking. The 0.001 ℏ was never a fee. It is the commitment.