> For the complete documentation index, see [llms.txt](https://docs.zetrix.com/zetrix-l2-documentation/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.zetrix.com/zetrix-l2-documentation/reliability-and-security/security.md).

# Security

## RPC Security

* Public endpoint exposes only safe method namespaces.
* Admin/debug (`admin_`, `debug_`, `txpool_` management) restricted to internal networks.
* Rate limiting and WAF at the edge; TLS enforced.

## Committee Security

* Independent signing keys per Validator (HSM/KMS).
* Each member validates independently before signing (no blind co-signing).
* Diverse hosting to avoid correlated compromise.

## Assertion Security

* Assertions reference reproducible batch data.
* Proposer key protected (HSM/KMS).
* Invalid assertions are caught in the challenge window.

## Fraud Proofs

* Deterministic re-execution underpins fraud detection.
* On-chain dispute game resolves contested transitions.
* Security reduces to ≥1 honest, funded Watcher.

## Watcher Security

* Encourage multiple **independent** Watchers (external operators).
* Watchers must pin the exact EVM ruleset and keep dispute accounts funded.

## Access Control

| Surface                    | Control                                |
| -------------------------- | -------------------------------------- |
| Public RPC                 | Method allowlist, rate limit, TLS      |
| Admin/Validator dashboards | Auth + IP allowlist / VPN              |
| Servers                    | SSH key-only, bastion, least privilege |
| CI/CD                      | Scoped credentials, signed artifacts   |

## Secrets Management

* Store keys in HSM/KMS or a secrets manager (e.g., AWS KMS/Secrets Manager, Vault).
* No plaintext keys in configs, images, or environment files committed to VCS.
* Rotate keys on a schedule and on suspected compromise.

> \[!WARNING] The Sequencer, Proposer, Refueler, and Faucet all control funded EOAs. Compromise of these keys has direct financial impact. Mandate HSM/KMS, spend limits, destination allowlists, and anomaly alerting.

## Infrastructure Recommendations

* Network segmentation (public / consensus / management subnets).
* Security groups: least-privilege, per [Appendix firewall rules](/zetrix-l2-documentation/reference/appendix.md#recommended-firewall-rules).
* OS hardening, automated patching, image scanning.
* Audit logging on all privileged access.

***

[← High Availability](/zetrix-l2-documentation/reliability-and-security/high-availability.md) · [Index](/zetrix-l2-documentation/readme.md) · [Monitoring →](/zetrix-l2-documentation/reliability-and-security/monitoring.md)