# Security

Both entries are mavweb's passkey seam. Assertion itself is sound and is not
the problem: `userVerification` is required, and a sign count that does not
increase is rejected.

## Anyone past the proxy can enroll a passkey [#683] {#enrollment}

Costs: registration is gated on nothing, so any client that reaches mavweb can
enroll its own key and become him. Step-up is worse than per-client: one
process-global `assertedAt` means every client inherits the same five-minute
window after any successful assertion. The voice WebSocket accepts every
origin, which makes cross-site use easier. V-317 covers which routes are gated
and V-605 covers challenge-map growth. Neither covers this.
Revisit when: mavweb is reachable from anything but the tunnel, and before any
new credential is enrolled.
Workaround: the reverse proxy is the only boundary today. That is the finding.

## Passkey credentials are rewritten in place [#684] {#credentials}

Costs: `os.WriteFile` over the live file. A crash, a full disk or an
interrupted write corrupts every enrolled credential at once, and mavweb will
not start afterwards.
Revisit when: a second credential is enrolled, since the blast radius grows
with the count. Sooner if the box loses power unexpectedly.
Workaround: back the file up before enrolling.