Minting Security
Authentication
Every minting mutation requires an authenticated session. Anonymous or public execution of the minting control plane is disallowed.
Role based access
Control plane isolation
The minting control plane (job submission, batch management, export generation) is separated from scan resolution. That separation gives you three guarantees:
- Minting operations cannot be triggered from a public scan.
- Scan resolution runs with minimal privileges and exposes no minting controls.
- No minting mutation is publicly callable.
Scan resolution security
- Scans capture aggregate telemetry with coarse geolocation. No consumer account is required and no personal profile is built.
- Bot traffic is detected and served static responses without recording telemetry.
- Activation changes are validated and access controlled, so a public scan cannot alter a unit’s activation state.
Export security
Export artefacts are stored privately and access controlled:
- Only members with brand level access can request and download exports.
- Downloads use short lived signed URLs that expire automatically.
- No permanent public URLs are created for export artefacts.
Idempotency protection
Idempotency keys prevent duplicate job creation from repeated submissions, so a replayed or retried request cannot create unintended minting activity.
Concurrency safety
Exclusive job locking during background processing means:
- Only one worker processes a given job at a time.
- No duplicate tokens or serial numbers are generated under concurrent load.
- Partial progress survives a worker failure.