The signing key stays separate from the public site.

Signing-key isolation

The production Ed25519 private key is stored as a Cloudflare Worker secret in a dedicated signer Worker. That signer has no public Worker route, no workers.dev URL and no preview URL.

The public site reaches the signer through a private Cloudflare Service binding and exposes only the public Web Bot Auth key directory. The request-signing endpoint is not available on the public internet.

Key rotation

We can publish an old and new public key together for a short overlap, then switch request signing once the new key has been checked. The private keys stay inside the signer Worker.

Environment separation

Development, staging and production identities use separate keys and runtime configuration. A non-production key must not be treated as the production NBT identity.

Report a security issue

Email security@nbt.bot with a short description, affected URL or component, timestamps and reproduction detail where safe. Please do not send live credentials or customer data.

Machine-readable disclosure information is at /.well-known/security.txt.