LingerCut
Request accessCustomer sign in

Security — operational honesty, not a badge

How LingerCut signs a kill receipt — and what that does not prove

Cut out-of-band. Replay the old grant. Stamp VALID only on bounce. The signature proves the receipt bytes were not altered. It does not prove leftover access is gone unless an independent replay was recorded.

Threat model

After phishing, a vendor incident, or password rotation, leftover sessions, OAuth grants, refresh tokens, API keys, and connected-app trust often stay alive. The compromised vendor must not be the only verifier of leftover trust in that vendor. LingerCut assumes the interactive session may already be stolen, so the cut is out-of-band. We do not trust revoked: true from an IdP API.

  • In scope: leftover grants and sessions LingerCut can inventory and cut (live GitHub, GitLab, Google, Entra, AWS IAM when those connectors are configured); independent failed-replay or absence probes; tamper-evident kill receipts. GitLab CI job tokens and runner authentication tokens are lab illustrations only.
  • Out of scope: replacing Okta/Entra, EDR, password managers, or SSPM; claiming SOC 2 / ISO / FedRAMP; live cuts from this public site or from Live desk.

Trust boundaries

Where cut, probe, and receipts actually live

The IdP is NOT the verifier. A kill receipt is VALID only if isolated replay bounced. Vendor revoked:true is not ground truth. Live Desk never cuts.

LingerCut trust-boundary diagramCut app is Next.js on Vercel -- API routes are the backend. Receipts persist to Upstash Redis REST on SaaS or local .data on sovereign. Probe is a separate origin. Sovereign is buyer Docker Compose. AWS IAM is a customer connector target only. The IdP is not the verifier.SaaS plane (not a green dashboard)Cut appNext.js on VercelAPI routes ARE the backendReceiptsUpstash Redis RESTor .data on sovereignProbelingercut-probe.vercel.appseparate originAWS IAMcustomer connector onlynot LingerCut home cloudIdPNOT the verifierrevoked:true is not proofSovereignBuyer Docker Compose + volume /app/.dataBuyer host only -- never founder laptop, never LingerCut-operated AWS VPCSame Next.js app. Data does transit the cut host, including Vercel on SaaS.
  1. Cut app -- Next.js on Vercel. API routes ARE the backend. Not a separate AWS service. Vercel is not UI-only.
  2. Receipts ledger -- Upstash Redis REST (SaaS) or local .data (sovereign). HTTP fetch to Upstash when UPSTASH_REDIS_REST_* are set; else /app/.data on the buyer host. Not AWS S3, RDS, or DynamoDB.
  3. Probe plane -- Separate origin -- lingercut-probe.vercel.app. In-process lab unless PROBE_BASE_URL points at another origin. Live Desk / OpenAI never cuts and never stamps VALID.
  4. Sovereign -- Buyer Docker Compose + volume /app/.data. Runs on the buyer's host -- their VPC, government cloud, or on-prem. Never the founder laptop. Never a LingerCut-operated AWS VPC.
  5. AWS IAM -- Customer connector target only. Called FROM Vercel API routes. AWS is not LingerCut's home cloud.
  6. Verifier -- The IdP is NOT the verifier. A kill receipt is VALID only if isolated replay bounced. Vendor revoked:true is not ground truth.

Independent cut and adversarial replay

Protection is the cut. Checking is an independent probe of the old credential — not HMAC, not the vendor revoke API. VALID (CUT / BOUNCE) only if that probe fails. WITHHELD if the leftover is still live, even when the vendor is green. Transport failure is probeError — never a fake WITHHELD.

What is signed, and how keys are handled

Kill receipts are canonicalized (fixed key order, sorted scopes; signature fields excluded) then signed on the server. The private key never ships to the browser. We do not generate Ed25519 theater in JavaScript.

  • Ed25519 when RECEIPT_ED25519_PRIVATE_KEY is set (PKCS8 PEM). Public key is published at /verify and GET /api/proof/keys. Independent check: recompute canonical JSON + published public key.
  • HMAC-SHA256 when only RECEIPT_SIGNING_SECRET is set. That is a shared-secret MAC. The secret is never published, so HMAC receipts can only be checked on LingerCut's signing host. Honest, not a public-key proof.
  • kid (default k1) plus optional previous key for verify-only overlap after rotate. Mint uses the current key only.
  • Signature = integrity of the receipt bytes. Replay bounce vs still-live = liveness.

What /verify proves and does not prove

A visitor pastes receipt JSON. LingerCut does not call the vendor API. Invalid reasons are named: bad JSON, unknown key, unknown algorithm, content-hash mismatch (tampered fields), signature mismatch.

  • Proven on valid: canonical bytes match the signature under the published key (Ed25519) or the host HMAC secret.
  • Not proven: leftover access is gone, unless the receipt itself records an independent replay bounce. Vendor revoked=true is never ground truth.
  • Lab leftovers lc_gt_01, lc_ms_02, and other lc_* rows are labeled illustration / synthetic on every receipt surface — including when they are actually server-signed.

Open /verify · Lab demo

Data handled

Access requests store name, work email, company, country/region, why you contacted, and consent — so we can reply. Secrets are not logged. Kill receipts hold grant metadata and probe outcomes, not visitor passwords. Public SaaS runs on Vercel (Washington, D.C.). Receipts persist to Upstash Redis when configured, otherwise local .data (ephemeral on Vercel). See /privacy and /trust.

Limitations — no green-dashboard theater

  • LingerCut is not SOC 2, ISO 27001, NIST, FedRAMP, DORA, or GDPR certified. Control mapping on /trust is design intent, not an audit opinion.
  • CAEP ingest at /api/hooks/caep is CAEP-inspired — not an OpenID CAEP certificate or Shared Signals Framework implementation.
  • In-process probe is lab. Production independence wants PROBE_BASE_URL on a separate origin.
  • Live desk cannot cut and cannot stamp VALID.

Founder

Ugochukwu Eneh builds LingerCut. Public mailbox hello@lingercut.com. Requests go through /access so a lead is stored even if mail fails.