Security & integrity

The SDK’s security model — environment integrity, redaction, and trust boundaries.

This page documents the verified security contract of the SDK. It is also your surfacing point for pre-purchase environment checks.

Trust boundaries

MusterBox backend        ← authoritative for →
  player identity/sessions
  game-key validation (origin-scoped)
  match claim reconciliation
  wallet custody (MPC)

SDK (device)             ← responsible for →
  env integrity pre-flight before purchases
  buffering/flushing events
  reporting security events
  redacting secrets in diagnostics
  never deciding outcomes / never signing wallets

The SDK is a bridge, not intelligence.

Environment integrity check

check_environment_integrity() probes the host for common tamper indicators:

use musterbox_sdk::security::check_environment_integrity;

let env = check_environment_integrity();
// env.level: LEVEL_SAFE | LEVEL_WARN | LEVEL_COMPROMISED
// env.risks: [{ name, supported, detected }]

Level	Meaning
LEVEL_SAFE	Clean host
LEVEL_WARN	Non-critical risk detected
LEVEL_COMPROMISED	Critical risk (root/jailbreak, debugger) detected

Purchase pre-flight refuses to mint a PIN session when any risk is detected — see Secure purchases.

Risk identifiers

The SDK classifies host risks including (not exhaustive):

• DEVICE_ROOTED / jailbreak
• DEBUGGER_ATTACHED
• SCREEN_RECORDING_ACTIVE
• SUSPICIOUS_ACCESSIBILITY

Critical risks (DEVICE_ROOTED, DEBUGGER_ATTACHED) force COMPROMISED; all others force WARN.

Secret redaction

Diagnostics and config inspection redact secrets: base URLs, bearer tokens, PINs, and key material are masked before anything is logged or exported. Verify with:

musterbox config inspect --file musterbox.toml   # redacted output

Security commands

The MusterBox CLI ships operational security tooling for your build:

musterbox security audit            # secrets, licenses, advisories
musterbox security sbom             # generate an SBOM (SPDX)
musterbox certify                   # production certification suite

The certificate gate

musterbox certify --suite all runs the production certification suite (54/54 tests at the time of writing) and can emit compatibility-matrix.json. Run it in CI before releasing an engine build.

If you spot an incident

Report environment anomalies and client-side incidents via the SDK’s security event channel, then follow Report a security incident.

Next: Errors.