Cody

The client checks that the seal event’s author matches the author claimed in the rumor it wraps, so the attack you describe wouldn’t work. Anyone who knows your pubkey can fabricate a rumor event claiming to be from you, with any content they like. But they can’t produce a valid seal for it that other clients would accept.

2026-08-25 14:11:43 UTC

- reply

For now, the code is only hosted on GitHub because I still rely on GitHub Actions. Do you not have a GitHub account, or are you unable to submit a PR? If it’s the latter, please try again. I just realized I’d blocked PRs from first-time contributors because I was getting so many spam PRs from bots.