vanity-fleet generates an ed25519 secret key on rented cloud hardware. This document describes what protects that key and what does not.

• Zero egress. The fleet security group has no outbound rule. A grind node cannot reach the internet, S3, or any other host. The only traffic is inbound SSH from your /32 and the stateful reply on that connection.
• Secret never touches disk. vanity writes results to /dev/shm (tmpfs). Nothing is written to EBS, so no snapshot or AMI can contain a key.
• Pull, not push. Keys are retrieved by bin/poll.sh over SSH from your machine and verified locally with solana-keygen before being saved with mode 600.
• Self-built AMI. The image is baked by you from the official AWS Deep Learning base AMI plus cargo install vanity. No third-party image is trusted.
• Credential-free kill switch. make grind sets an AWS-side valid_until so the fleet terminates even if your session expires and tofu destroy cannot run.
• Locked-down operator key. make key creates a dedicated ed25519 SSH key used only for this project; it is gitignored along with every *.pem, *.pub and *.json.

Anyone who can read /dev/shm on a grind node can read the secret before you do:

• AWS itself, at the hypervisor layer.
• Any IAM principal in your account who can attach to the instance (EC2 Serial Console, SSM Session Manager if the agent is enabled, or by modifying the security group to allow their own IP). Each of these actions is recorded in CloudTrail.
• Anyone at the ssh_cidr address with the private key.

This exposure cannot be engineered away. Other curves allow "split-key" grinding, where the searcher only ever sees a public key and the owner combines the result with a private component afterwards. Ed25519 derives its signing scalar by hashing a 32-byte seed, and every standard Solana keypair file, wallet, CLI and validator expects that seed. A combined scalar has no seed that hashes to it, so the machine that finds the key must hold the full secret in memory. Whether that is acceptable depends entirely on what the key will control once it exists.

Please use GitHub's private vulnerability reporting on this repository rather than a public issue. Include the affected file and a reproduction if you have one.