Security research on Knox — scope, rules, safe harbor.

No claims — only counts. Every line below is a verifiable artifact, not a marketing assertion. Re-check any of them in your terminal.

Verify-yourself one-liners

# Anchor cadence (Cloud Scheduler) — public, no auth needed:
curl -sS https://bonissystems.com/api/knox/health | jq

# Post-quantum signature capability descriptor:
curl -sS https://bonissystems.com/api/knox/agents/crypto-signature | jq .pqc_algorithms

# Post-quantum KEM capability descriptor (Layer 10):
curl -sS https://bonissystems.com/api/knox/agents/crypto-kem | jq .supported_algorithms

# Edge-defense headers — should include x-knox-shield:
curl -sI https://terravaulthq.com/

Article V.8 — Knox watches Knox. The platform anchors its own operational state to itself, then to Bitcoin. The numbers above are produced by the system the page describes; the verifier is the same one published at /legal-kit/bonis-verify.mjs.

Email — and anchor your report to Knox before you send it

Send a coordinated-disclosure report to [email protected] with subject line [Knox Security] <short summary>. Include:

• Clear description of the finding and its category (forgery / bypass / spec-unsoundness / info-disclosure / other).
• Steps to reproduce — shell commands, curl calls, or a minimal script.
• The artifact that makes the finding concrete (a Knox anchor ID, a SHA-256, a payload, a spec state trace, a zero-dep-verifier transcript).
• Your preferred attribution name and contact for coordinated-disclosure follow-up.

Recommended — anchor your report to Knox before sending

Before emailing Bonis Systems, compute the SHA-256 of your report file and anchor it. This gives you a Bitcoin-backed timestamp of the report you are about to send, that cannot be disputed later by either side. Anchoring requires a Knox Bearer key — provision one by signing up at /bonis (free tier covers 10,000 anchors / month after email verification). Then:

# 1. Hash your report (any file type)
HASH=$(shasum -a 256 knox-finding-report.pdf | awk '{print $1}')

# 2. Anchor the hash — Bearer key required (export KNOX_KEY first)
curl -sS -X POST https://bonissystems.com/api/knox/public-anchor \
  -H "Authorization: Bearer $KNOX_KEY" \
  -H "Content-Type: application/json" \
  -d "{\"hash\":\"$HASH\",\"filename\":\"knox-finding-report.pdf\",\
      \"sizeBytes\":$(stat -f%z knox-finding-report.pdf),\
      \"mimeType\":\"application/pdf\"}"

# 3. The response returns {anchor: {anchorHash, sequence, verifyUrl, ...}, affidavit}
#    Include that anchor in your email so both parties have a public
#    timestamp of when the finding was reported.

Why: the same permanence primitive that makes Knox worth reporting bugs against also makes the reporting itself tamper-evident. Neither party can later dispute when the finding arrived or what it contained.

Research conducted in good faith against the in-scope targets above is authorized by Bonis Systems LLC and shall not be the basis for legal action. Good faith means:

• You do not exfiltrate data beyond what is strictly necessary to prove the finding.
• You do not disclose findings publicly before coordinated-disclosure embargo ends (see SLA above).
• You do not test against actual customer data you know to be in production — synthetic inputs only.
• You do not demand payment in exchange for withholding a finding; this is not a paid bounty, it is a responsible-disclosure program.
• You operate within the applicable laws of your jurisdiction and ours (Wyoming, United States).

This language is a policy commitment, not a contract of adhesion, and is not intended to waive any rights beyond the in-scope testing activities above. If in doubt about whether a specific probe is authorized, email first and ask.

No validated findings have been reported against the in-scope targets to date. When the first valid finding is reported, resolved, and retested, this section will publish — with the reporter's credit — the finding summary, the Knox anchor of the original report, the Knox anchor of the fix commit, and the retest transcript. Every entry will itself be Knox-anchored.

The absence of entries below this paragraph is a statement Bonis Systems expects to have to revise. It is published as-is per the Truth Protocol: claiming a populated hall of fame without entries would be a fabrication, and silence until the first entry is what the Smartest People Standard requires.

What this does NOT prove

This walkthrough shows the tamper-evidence primitives are sound, given that SHA-256 is collision-resistant and Bitcoin's header chain cannot be retroactively rewritten by an adversary with less than a majority of global hashpower. It does not prove:

• That every record the system has ever issued was correctly anchored — that requires independent log review, which the published TLA+ spec and zero-dep verifier enable.
• That every Knox agent's operational decisions are well-formed — that is the purpose of the Knox-watches-Knox dogfooding layer documented at /bonis/knox-watches-knox.
• That the evidentiary envelope (signers, geo, oracles) is truthful — Knox anchors what was presented to it. Falsity in the submitted envelope is an application-layer concern; Knox's role is permanence of the record, not truth of the content.

Findings in any of the three categories above are in scope and valued. The point of this page is to make the contract explicit.