# Security model

Zero-trust verification anchored in the physical tag.


TAGBASE assumes every link, device, and client may be compromised. Trust is
anchored in the one thing that can't be faked: the genuine physical tag.

## Principles

- **Anchored in hardware.** Authenticity depends on material that only a genuine
  tag can produce, freshly, on every tap.
- **Two-scan liveness.** A valid URL is not enough: the same live tag must
  produce two distinct taps, which a static copy cannot do.
- **No secrets in the client.** All verification logic runs server-side, and the
  browser is treated as untrusted.
- **Time-bound.** The two taps must happen within a short window, which defeats
  link harvesting and replay.

## The two-scan check

Verification requires two taps from the same live tag within a short window. The
first tap opens a `pending` verification; the second must present new material to
reach `valid`. A replayed tap is treated as a likely clone and rejected. See
[how it works](/docs/overview/how-it-works) for the full flow.

## The seal

Tags can be ordered with a **tamper seal**: a physical loop across the packaging
that the tag checks on every tap. Each scan then reports whether the product has
been opened, alongside the authenticity verdict.

The seal answers a different question than the two-scan check. Authenticity asks
whether this is the genuine tag. The seal asks whether the package has been
opened. A real product in an opened box verifies as valid and reports its seal as
opened. Act on that for goods that should still be closed, and expect it for
anything a customer has already unpacked.

A tag measures the loop only while a tap powers it, so a seal cut and repaired
between two taps reads as intact. The seal is a second signal on top of the
authenticity check, covering the moments around a scan.

## Threats and mitigations

| Threat | Mitigation |
| --- | --- |
| Cloned tag | A static copy replays one tap and fails the second (liveness). |
| Link replay | Verification URLs are single-use and time-bound. |
| Client tampering | Verification runs server-side; clients hold no secrets. |
| Opened packaging | A tag with a seal reports the seal state on every tap. |

## Optional signals

Geolocation and device signals can flag unexpected tap patterns, and every tag
keeps a verification history for audit and compliance.

> One-step mode (showing product info on the first tap) trades away the
> second-scan liveness proof for a simpler experience. It's available per team
> but discouraged, since a captured URL works once.

That's the theory. Next, set yourself up and write a tag of your own:
[your first product](/docs/getting-started/your-first-product).