Please report suspected vulnerabilities privately rather than through a public issue.

Trust Vault treats the server-issued random validator as the actual trust credential.

The selector identifies the candidate database row. The validator proves possession. Only a SHA-256 hash of the validator is stored in the database.

IP addresses, User-Agent strings, browser names, and platform names are informational metadata. They are never treated as proof of device identity.

Applications should enroll a device only after a recent step-up verification, such as password confirmation, TOTP, a passkey, or another factor suitable for the application.

If a valid selector is presented with an invalid validator, Trust Vault revokes that device record and emits a compromise event.

A trusted device should reduce unnecessary friction where appropriate, but it should not replace authorization or fresh authentication for high-risk operations.