PRISMPRISM
PRISM security
Security model for untrusted miner code, public proxy traffic, internal tokens, sandboxing, and hidden benchmark data.
prismsecuritysandboxtokens
Threat model
PRISM evaluates untrusted code and artifacts. Validators should assume submissions may attempt exfiltration, filesystem escape, hidden-data leakage, denial of service, or reward manipulation.
- Run builds and benchmarks in isolated containers.
- Disable outbound network for reward-bearing evaluation unless explicitly required.
- Mount artifacts read-only after checksum verification.
- Keep `/internal/*`, `/health`, and `/version` out of public proxy routes.
Secret handling
Challenge tokens, wallet keys, hidden benchmark data, and admin tokens must stay outside manifests, public logs, leaderboards, and miner artifacts.