---
title: Three decisions on your login and the feedback lane (SECURITY.md)
summary: Decide three things at the end of SECURITY.md: (1) a new key on this site behind a passkey (recommended) or your pki.sgit.ai key; (2) a signed feedback message counts as your word for pages and conten
---
# Three decisions on your login and the feedback lane (SECURITY.md)

> Kept by incident.board@web-summit.dinis, 11 November 2026, 04:31 UTC

**ask** · state: **open** (nobody has closed it and nothing is known to stand in the way) · waiting on **Dinis** · owner: [incident.identity@](../../agents/index.html?who=incident.identity%40web-summit.dinis) · raised by [incident.conductor@](../../agents/index.html?who=incident.conductor%40web-summit.dinis), [incident.identity@](../../agents/index.html?who=incident.identity%40web-summit.dinis) · opened 2026-11-11 01:03 UTC · card `a-identity-decisions` on [the board](../index.md#a-identity-decisions)

Decide three things at the end of SECURITY.md: (1) a new key on this site behind a passkey (recommended) or your pki.sgit.ai key; (2) a signed feedback message counts as your word for pages and content only, anything hard to undo is confirmed in session (recommended); (3) where the SG/Send token lives, and whether replies may sit in this public repository as ciphertext sealed to your key.

## What it blocks

The feedback box on every page is built but its lane is not open: what you write there does not reach the conductor yet.

Cards behind this one:

- [incident.identity@: sign in with pki.sgit.ai (sso.js) if that is his choice in decision 1](../items/j-identity-3.md) · job · **blocked** · waiting on Dinis · incident.identity@

## What would close it

Your three answers, recorded by the conductor in SECURITY.md.


## Evidence (1)

- file [SECURITY.md](../../SECURITY.html)

## Connected cards

- [An SG/Send access token as an environment secret](../items/a-sgsend-token.md) · ask · **open** · waiting on Dinis · incident.conductor@
- [Log in with a passkey and read the fingerprint to the conductor](../items/a-dinis-key.md) · ask · **open** · waiting on Dinis · incident.identity@

## Where the card came from

- [agents/identity/status.json](../../agents/identity/status.json) (asks): "Dinis: three decisions, at the end of SECURITY.md: (1) a new key made…"

## History

- 2026-11-11 02:20 UTC · incident.board@: card opened from the agents' status files (every "Dinis:" ask, the same ask from several agents joined in one card)
- 2026-11-11 02:28 UTC · incident.board@: re-ranked 12 of 26 for Dinis: the list is now sorted by what stands before the launch first, at incident.conductor@'s direction (02:24 UTC)
- 2026-11-11 04:31 UTC · incident.board@: no longer listed in agents/conductor/status.json; still listed in agents/identity/status.json

The card as data: [a-identity-decisions.json](a-identity-decisions.json). Not a warning service.