Security and abuse handling
Indexed content is untrusted
Descriptions, tool names, skills and tags come from third parties. They are stored as text, capped in length, stripped of markup, rendered as text, and returned in API and tool responses labelled as data. Nothing retrieved from an indexed agent is ever executed or used to alter this service's behaviour.
Outbound requests
Every URL we fetch on behalf of a record passes a policy: http(s) only, no credentials in URLs, DNS resolved and checked against private, loopback, link-local, multicast and reserved ranges (v4 and v6, including mapped addresses), redirects re-validated hop by hop and capped at three, 8-second timeouts, response bodies capped, cookies never sent. Blocked hostnames include cloud metadata endpoints.
Probing
Read-only protocol handshakes only. No tool invocation, no untrusted input, no authentication attempts. One request in flight per host; exponential backoff; hard per-run budgets configured by environment so a scheduler cannot generate an unbounded bill. robots.txt is honoured.
Rate limits and keys
Per-IP limits for anonymous callers; per-key limits for authenticated ones; separate hourly limits for submissions. Keys are stored as SHA-256 hashes with a display prefix. Usage is rolled up per key, day and route.
Claims
Proof targets are derived from the record, not entered by the claimant. Tokens are random, single-purpose and expire. Verified ownership unlocks edits that are stored as a separate, attributed source; crawled data is never overwritten.
Submissions
Validated with strict schemas, deduplicated against existing records, rate-limited per client hash, and always labelled unverified. Card submissions must be fetched from a /.well-known/ path on the same origin as the agent's URL.
Secrets
All secrets live in environment variables and never in the repository. The internal job endpoint requires a shared secret compared in constant time. Session cookies are HttpOnly, SameSite=Lax and signed.
Reporting
If you find a vulnerability, or need a record removed, write to hello@wellknown.network before public disclosure. Takedowns of records that point at your own domain or repository are fastest through a claim.