Skip to content

Security, consent and trust

Alpha, single tenant

Do not enroll untrusted public workers or submit confidential production data. There has been no independent security review or enterprise certification.

Implemented boundaries

  • Distinct administrator and enrollment secrets. Individual worker tokens are returned at enrollment and stored hashed in the broker database.
  • Administrators submit/cancel jobs, view results/audit history and revoke worker tokens. Workers cannot read arbitrary prompts/results or submit jobs.
  • Compatible work is claimed transactionally. A job has one active lease. Heartbeats renew it; late, cancelled, foreign and duplicate results are rejected.
  • A worker may advertise capabilities, but that is a declaration, not hardware attestation. Enrollment is a trust decision by the coordinator.
  • No executable code, container image URL, arbitrary training script or inference URL is accepted from task payloads. Training scripts and endpoints are local administrator configuration.
  • Browser participation requires consent, is visible and stoppable, and pauses when hidden. Do not use it on devices you do not own or administer.

Worker enrollment is not anonymous membership verification. Someone with the join key can enroll multiple identities. Proof credit is not Sybil-resistant, not a payment system, and not evidence of unique contributors or elapsed effort.

Data and operational risks

Prompts, parameters and results are plaintext in SQLite and are disclosed to the assigned worker. An authenticated contributor could falsify inference or training output. Only nonce solutions are cheaply checked by the broker; search exhaustion and other outputs are not independently verified. Keep secrets out of payloads and use trusted workers for sensitive work.

Use TLS, edge rate/request-size limits, restricted enrollment and filesystem permissions. Browser local storage is accessible to same-origin scripts: protect the application origin, dependencies and browser profile. The opt-in Gemma loader downloads third-party code and weights from external CDNs/model hosting. Review licenses and egress policy before enabling it.

Do not run the worker as root. Training profiles are trusted executable code and need review and cluster quotas. Default job delivery is at-least-once, not exactly-once. Cancellation cannot guarantee that an upstream HTTP inference server stops generating; its result will be discarded once the lease is lost.

Enterprise gates still required

OIDC/RBAC and tenant isolation; rate limiting; encrypted managed storage and retention; HA/failover; signed provenance; resilient Slurm recovery; independent result auditing; workload quotas; metrics/alerts; SBOM and dependency review; real hardware testing; App Store/native mobile review where applicable.