> ## Documentation Index
> Fetch the complete documentation index at: https://docs.musterbox.org/llms.txt
> Use this file to discover all available pages before exploring further.

# Security & integrity

> The SDK's security model — environment integrity, redaction, and trust boundaries.

This page documents the verified security contract of the SDK. It is also your
surfacing point for pre-purchase environment checks.

## Trust boundaries

```text theme={"dark"}
MusterBox backend        ← authoritative for →
  player identity/sessions
  game-key validation (origin-scoped)
  match claim reconciliation
  wallet custody (MPC)

SDK (device)             ← responsible for →
  env integrity pre-flight before purchases
  buffering/flushing events
  reporting security events
  redacting secrets in diagnostics
  never deciding outcomes / never signing wallets
```

The SDK is a **bridge, not intelligence**.

## Environment integrity check

`check_environment_integrity()` probes the host for common tamper indicators:

```rust theme={"dark"}
use musterbox_sdk::security::check_environment_integrity;

let env = check_environment_integrity();
// env.level: LEVEL_SAFE | LEVEL_WARN | LEVEL_COMPROMISED
// env.risks: [{ name, supported, detected }]
```

| Level               | Meaning                                           |
| ------------------- | ------------------------------------------------- |
| `LEVEL_SAFE`        | Clean host                                        |
| `LEVEL_WARN`        | Non-critical risk detected                        |
| `LEVEL_COMPROMISED` | Critical risk (root/jailbreak, debugger) detected |

Purchase pre-flight refuses to mint a PIN session when any risk is detected —
see [Secure purchases](/sdk/purchases).

## Risk identifiers

The SDK classifies host risks including (not exhaustive):

* `DEVICE_ROOTED` / jailbreak
* `DEBUGGER_ATTACHED`
* `SCREEN_RECORDING_ACTIVE`
* `SUSPICIOUS_ACCESSIBILITY`

Critical risks (`DEVICE_ROOTED`, `DEBUGGER_ATTACHED`) force `COMPROMISED`;
all others force `WARN`.

## Secret redaction

Diagnostics and config inspection **redact** secrets: base URLs, bearer
tokens, PINs, and key material are masked before anything is logged or
exported. Verify with:

```bash theme={"dark"}
musterbox config inspect --file musterbox.toml   # redacted output
```

## Security commands

The MusterBox CLI ships operational security tooling for your build:

```bash theme={"dark"}
musterbox security audit            # secrets, licenses, advisories
musterbox security sbom             # generate an SBOM (SPDX)
musterbox certify                   # production certification suite
```

## The certificate gate

`musterbox certify --suite all` runs the production certification suite
(54/54 tests at the time of writing) and can emit
`compatibility-matrix.json`. Run it in CI before releasing an engine build.

## If you spot an incident

Report environment anomalies and client-side incidents via the SDK's security
event channel, then follow [Report a security incident](/guides/report-security-incident).

Next: [Errors](/sdk/errors).