Trust & verification

Security alert triage

What fired, why it is expected, and how to block it.

Browser-visible hosts and when they are used:

To block ProtocolSoup, deny protocolsoup.com and *.protocolsoup.com in DNS filtering, a secure web gateway, or an outbound proxy. To stop only live event streaming, deny wss://protocolsoup.com/ws/lookingglass/*. Closing the tab stops browser activity; there is no endpoint component to uninstall.

What ProtocolSoup is

The product, hosted service, and data it touches.

ProtocolSoup is an open-source, vendor-neutral reference implementation for identity protocols. It runs real OAuth 2.0, OpenID Connect, OpenID4VCI, OpenID4VP, SAML, SPIFFE/SPIRE, SCIM, and Shared Signals flows so users can inspect the requests, responses, tokens, assertions, and validation decisions.

Trust boundary

Where requests and state cross an operator or provider boundary.

A browser connects to Cloudflare, which provides DNS and HTTP proxying, then to the ProtocolSoup applications on Fly.io. The wallet is a separate browser origin. Application state is held in memory, on Fly volumes, or in a Fly Redis service depending on the protocol feature.

Browser
  -> Cloudflare (DNS and HTTP proxy)
    -> Fly.io (ProtocolSoup, wallet, docs, SPIRE)
      -> memory / Fly volume / Fly Redis, depending on the flow

You can inspect public source, endpoints, image signatures, provenance, and the SBOM. You cannot independently inspect the hosted instance’s live environment variables, provider control planes, or whether the running process still matches the most recently published image. Self-hosting removes that operator-runtime assumption.

Self-hosting and verification

Run the published code inside a boundary you control.

git clone https://github.com/ParleSec/ProtocolSoup.git
cd ProtocolSoup/docker
docker compose up -d --build

Review the repository quick start and deployment documentation. For a prebuilt gateway, resolve and pin an immutable signed digest before deployment; do not deploy the moving latest tag as your trust anchor.

Verify the supply chain

Resolve the current digest, then verify that immutable image.

The latest tag moves whenever a new gateway image is published, so this page does not pin a digest that will go stale. Resolve the current multi-platform index digest and substitute it into every command below.

docker buildx imagetools inspect ghcr.io/parlesec/protocolsoup-gateway:latest
# Copy the top-level Digest value, then pin every subsequent command:
IMAGE='ghcr.io/parlesec/protocolsoup-gateway@sha256:<current-index-digest>'

Verify GitHub’s provenance attestation and bind the digest to the ProtocolSoup repository (--format json keeps the result explicit and machine-readable):

gh attestation verify "oci://$IMAGE" --repo ParleSec/ProtocolSoup --format json

Verify the independent Sigstore signature and the publishing workflow identity:

cosign verify \
  --certificate-identity-regexp 'https://github.com/ParleSec/ProtocolSoup/.github/workflows/ghcr-publish.yml@refs/heads/master' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  "$IMAGE"

Inspect the SPDX SBOM attached to that same immutable digest:

docker buildx imagetools inspect "$IMAGE" --format '{{ json .SBOM }}'

The publishing workflow builds linux/amd64 and linux/arm64 images, signs the resulting index, and publishes provenance and an SBOM. Trivy HIGH and CRITICAL findings are reported to code scanning but do not block publication; Snyk scan steps also continue on error. Treat those as visibility controls, not a release gate.

Hosted data and retention

What persists when you use protocolsoup.com.

SCIM requires an Authorization header. The browser keeps short-lived correlation values such as PKCE verifiers, OAuth state, OIDC nonces, and pending wallet flows in sessionStorage. Recent command-palette searches are the only ProtocolSoup value stored in localStorage.

The public applications run as single Fly machines in Sydney. There is no second replica, published SLA, or public status page. A machine, region, provider, or operator failure can make the demonstration unavailable. Fly volume snapshots are retained for five days.

ProtocolSoup does not deploy first-party product analytics. Cloudflare-managed browser telemetry or network error reporting may still be requested from Cloudflare domains.

Certified surface

Named ProtocolSoup versions and OpenID profiles listed by OIDF.

Certification applies to the named ProtocolSoup version and profile pairs published on openid.net. It is not a blanket certification of every ProtocolSoup feature, protocol family, or the moving hosted deployment.

OpenID® and OpenID Certified™ are trademarks of the OpenID Foundation.

Governance and continuity

Who runs it and what happens if that person stops.

ProtocolSoup is maintained by Mason Parle under the ParleSec GitHub account. It is a single-maintainer project: CODEOWNERS assigns the repository to @ParleSec, and there is no separate incorporated ProtocolSoup entity.

Verify these controls in the LICENSE, contribution guide, and CODEOWNERS. If maintenance stops, the licence and public history allow an independent fork; they do not guarantee that one will be maintained.

Limits and assumptions

What has not been independently assured.

• The hosted service is an educational demonstration, not a production identity provider or availability dependency.
• Single-machine, single-region hosting means an infrastructure or operator failure is an outage.
• Public source and attestations let you verify code-to-image provenance; they do not prove the live runtime configuration, secret handling, or provider control-plane state.
• Published retention behaviour is implemented in code but is not backed by a contractual deletion guarantee.
• Automated dependency and vulnerability findings are reported, but high-severity results do not block every release path.
• SSF state, signing keys, and mdoc PKI persist. Do not put sensitive or production identity data into the hosted instance.

If those assumptions are not acceptable, block the public domains and run a reviewed commit or verified image inside your own environment.

Vulnerability disclosure

A contact that also works without JavaScript.

Report privately to mason@protocolsoup.com. Do not open a public GitHub issue. The acknowledgment target is 48 hours; remediation and disclosure timing are coordinated with the reporter.

In scope: ProtocolSoup application code, official Docker images published to GHCR, and documentation that could lead to insecure configurations. Third-party dependencies and modified self-hosted deployments are outside the project’s control.

Machine-readable policy: /.well-known/security.txt. This page was last reviewed 2026-08-22.