Data & safety
The public API is a deliberate subset of network truth. Anything that could harm operators, users, or the integrity of the security layer is kept off this surface.
Always public (safe)
- Chain ID, height, block hashes, state roots, and leader public key
- Verified settlement counts and aggregate reward statistics
- Activated names and their kinds (node / compute)
- Capacity ads: free slots, status, image labels, class, region
- Coarse globe coordinates (opt-in)
- Public identity badges and cert payloads meant for verification
- Registry CA public key
- Cash App cashtag used for activation fees
Never public
| Data | Why |
|---|---|
| IPv4/IPv6, ports, hostnames | Enables scanning, DDoS, and doxxing |
| Cloudflare tunnel / reverse-proxy URLs | Bypasses operator intent |
| Operator private keys / vault DEKs | Full account takeover |
| CA private seed | Forge network certificates |
| Capacity/admin service secrets | Spam capacity or mutate protected services |
| Node heartbeat private keys | Forge that node's public-presence signature |
| Raw MAC / forensic dumps | Compliance-sensitive; not a public signal |
| Bitcoin wallet mnemonics or WIF | Theft of funds |
| GRID recovery phrases / wallet encryption material | Wallet takeover |
| Solana reward keypair JSON | Control of the devnet reward address |
| Genesis signing and recovery private keys | Forge network authority |
| Unreviewed registration PII | Abuse and spam targeting |
Client responsibilities
- Pin HTTPS to grid-compute.com (or document mirrors carefully)
- Treat registry JSON as untrusted input — validate types/ranges
- Do not log webhook secrets
- Show humans
grid://name.grid, not internal locators - Rate-limit your own pollers; the network is shared
Integrity tips
When a realm presents a permanent cert, verify the signature against GET /api/registry/entity?ca=1. If verification fails, ignore the badge. Revoked or inactive statuses must clear any elevated trust UI.
Chain verification boundary
- Trust the configured Genesis public key, never a key supplied by an untrusted peer.
- Verify each block signature, previous hash, state root, and chain ID.
- Replay settlement allocation from committed inputs.
- Reject stale signed-truth epochs and peers on a verified ban list.
- Do not describe Genesis-led production as decentralized finality.
Heartbeat integrity
- Each node signs public-presence data with a dedicated Ed25519 key.
- The node id is derived from the public key; arbitrary ids cannot be claimed.
- Timestamps have a five-minute acceptance window.
- Random nonces are stored atomically per node and cannot be replayed.
- Map coordinates are rounded to 0.5° before public KV storage.
- No shared public mesh secret is distributed to node operators.
Wallet safety
The website never needs a recovery phrase. Ember and the CLI keep wallet material on the operator's machine. The Solana reward key at ~/.grid/keys/solana-reward.json is created with restrictive permissions and is never overwritten by grid solana create.
If you believe you found a data leak in a public endpoint (IP, key material, etc.), stop using the field and report responsibly via the project GitHub security contacts. Do not weaponize it.