pki.sgit.ai / origins / review
The cross-reference review, redacted for publication
This is a derivative, and the original is not published. The review as written names a rollout customer and unremediated security findings against code that is running now, with enough structure to prioritise an attack — its own guidance is that publishing that "is publishing an attack roadmap". Three classes of content were removed: the customer, finding identifiers, severities and preconditions, and specific weaknesses in live endpoints. Investor material and internal commercial classifications went too. What is kept is the narrative, the counts, the reality check and the design lessons — none of which help an attacker.
Why publish a derivative at all
Because the alternative is to cite a document nobody can read. This site's standard is that a claim should be checkable, and three of the corrections it applied at v0.1.7 — including one to its own algorithm claim — rest on this review. Publishing the parts that carry those corrections, and stating precisely what was withheld, is the honest middle. A redaction that announces itself is a stronger artefact than a summary that quietly omits.
Where this derivative is weak
- The line was drawn on judgement. Somebody with the original may reasonably disagree about where. The categories are stated so that disagreement is possible.
- It reports a review, not the code. The review's reading of the codebase has not been independently re-verified here. Where the two disagree, the code wins.
- It is a snapshot at v0.33.61, 20 August 2026. Counts and status age; the ratio it reports will not hold still.
Read the document
📄 Public edition · 20 August 2026 · rendered from the raw markdown (the source of truth)