> Documentation index: https://stilldeeppos.com/llms.txt

# Security of the StillDeep point of sale

> Registers that never touch the database, a server that re-checks every sale, signed offline codes, cards kept out of reach, post-quantum in progress.

Source: https://stilldeeppos.com/security

A point of sale handles money in a shop open to the public. StillDeep trusts no screen, no register and no extension: everything is checked by the code that applies it.

## Nothing from a screen is trusted

Every input is validated by the code that applies it, never only by the screen: the sales engine re-checks quantities and prices, the server re-checks totals, taxes and shift rules, and the database constraints remain the last line of defense. An open-source client cannot bypass a rule by sending a forged request.

## Registers never touch the database

Registers do not hold a database password. Every operation goes through a gRPC proxy on the business server, which knows each register, checks its permissions and records the operation. Each register has its own identity; there is no shared master account.

## Card payments stay out of StillDeep

Card payments go from the payment terminal straight to the processor with point-to-point encryption. Card numbers never go through StillDeep or the business server.

## Signed codes, verifiable offline

Receipts and tickets carry a QR code signed with ECDSA P-256 and encrypted with AES-256-GCM. A register can verify a ticket at the gate without the Internet. Employee badges and coupons are sealed by the server alone; registers only hold the public keys to verify them. Revoking a register revokes the keys it held.

## Extensions are contained

Everything an extension writes or returns is validated by the host. An extension that fails, times out or writes invalid data is stopped, its registrations are removed and the sale continues. Extensions are installed from a registry with SHA-256 checksums; package signing is in progress.

## Secrets and memory

No connection string or credential in configuration files: secrets are encrypted at rest and injected at startup. Keys in memory are scattered and locked in RAM, and on Linux and macOS the process cannot be dumped. Passwords are hashed with bcrypt.

## Post-quantum, in progress

The target is hybrid cryptography, classical plus post-quantum (ML-KEM, FIPS 203, and ML-DSA, FIPS 204), for register enrollment, extension signatures, AI tool tokens and the audit log. No communication will depend on post-quantum algorithms alone. This work is in progress, not delivered.

## Report a vulnerability

If you find a security issue on this site or in StillDeep, write to the security contact published in `/.well-known/security.txt`. Do not test on systems you do not own.