diff --git a/pyproject.toml b/pyproject.toml
index f696c06..8f9fde1 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -24,8 +24,8 @@ classifiers = [
     "Programming Language :: Python :: 3.13",
 ]
 dependencies = [
-    "cryptography>=42.0",
-    "numpy>=1.26",
+    "cryptography>=42,<46",
+    "numpy>=1.26,<3",
 ]
 
 [project.optional-dependencies]
diff --git a/rust/Cargo.lock b/rust/Cargo.lock
index 5f3a883..7d9d84d 100644
--- a/rust/Cargo.lock
+++ b/rust/Cargo.lock
@@ -656,6 +656,7 @@ dependencies = [
  "sha2",
  "thiserror",
  "unicode-normalization",
+ "zeroize",
 ]
 
 [[package]]
diff --git a/rust/Cargo.toml b/rust/Cargo.toml
index 013b08a..be82265 100644
--- a/rust/Cargo.toml
+++ b/rust/Cargo.toml
@@ -20,6 +20,7 @@ serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0"
 base64 = "0.22"
 unicode-normalization = "0.1"
+zeroize = "1"
 thiserror = "1.0"
 hex = "0.4"
 criterion = { version = "0.5", default-features = false, features = ["cargo_bench_support"] }
diff --git a/rust/vectorpin/Cargo.toml b/rust/vectorpin/Cargo.toml
index 7b1cc71..37b0dba 100644
--- a/rust/vectorpin/Cargo.toml
+++ b/rust/vectorpin/Cargo.toml
@@ -19,6 +19,7 @@ serde = { workspace = true }
 serde_json = { workspace = true }
 base64 = { workspace = true }
 unicode-normalization = { workspace = true }
+zeroize = { workspace = true }
 thiserror = { workspace = true }
 hex = { workspace = true }
 rand = "0.8"
diff --git a/rust/vectorpin/benches/perf.rs b/rust/vectorpin/benches/perf.rs
index b15ebb9..5ba829f 100644
--- a/rust/vectorpin/benches/perf.rs
+++ b/rust/vectorpin/benches/perf.rs
@@ -61,7 +61,7 @@ fn bench_hash_vector(c: &mut Criterion) {
 
 fn bench_sign(c: &mut Criterion) {
     let mut group = c.benchmark_group("sign");
-    let signer = Signer::generate("bench".into());
+    let signer = Signer::generate("bench".into()).expect("test signer generate");
     let text = make_text(1024);
     for &d in VECTOR_DIMS {
         let v = make_vector(d);
@@ -83,9 +83,11 @@ fn bench_sign(c: &mut Criterion) {
 
 fn bench_verify(c: &mut Criterion) {
     let mut group = c.benchmark_group("verify_full");
-    let signer = Signer::generate("bench".into());
+    let signer = Signer::generate("bench".into()).expect("test signer generate");
     let mut verifier = Verifier::new();
-    verifier.add_key(signer.key_id(), signer.public_key_bytes());
+    verifier
+        .add_key(signer.key_id(), signer.public_key_bytes())
+        .unwrap();
     let text = make_text(1024);
     for &d in VECTOR_DIMS {
         let v = make_vector(d);
@@ -111,9 +113,11 @@ fn bench_verify(c: &mut Criterion) {
 
 fn bench_verify_signature_only(c: &mut Criterion) {
     let mut group = c.benchmark_group("verify_signature_only");
-    let signer = Signer::generate("bench".into());
+    let signer = Signer::generate("bench".into()).expect("test signer generate");
     let mut verifier = Verifier::new();
-    verifier.add_key(signer.key_id(), signer.public_key_bytes());
+    verifier
+        .add_key(signer.key_id(), signer.public_key_bytes())
+        .unwrap();
     let text = make_text(1024);
     // Signature-only verification cost is independent of the vector
     // body — the dim doesn't enter the canonical header until vector
diff --git a/rust/vectorpin/examples/basic_usage.rs b/rust/vectorpin/examples/basic_usage.rs
index 2cbd7ee..02a6b62 100644
--- a/rust/vectorpin/examples/basic_usage.rs
+++ b/rust/vectorpin/examples/basic_usage.rs
@@ -10,7 +10,7 @@ fn main() {
     let embedding: Vec<f32> = (0..128).map(|i| (i as f32) * 0.01).collect();
     let source = "The quick brown fox jumps over the lazy dog.";
 
-    let signer = Signer::generate("demo-2026-05".to_string());
+    let signer = Signer::generate("demo-2026-05".to_string()).expect("test signer generate");
     let pin = signer
         .pin(source, "text-embedding-3-large", embedding.as_slice())
         .expect("pin creation");
@@ -20,7 +20,9 @@ fn main() {
     println!();
 
     let mut verifier = Verifier::new();
-    verifier.add_key(signer.key_id(), signer.public_key_bytes());
+    verifier
+        .add_key(signer.key_id(), signer.public_key_bytes())
+        .unwrap();
 
     // 1. honest verify
     let r = verifier.verify_full::<&[f32]>(&pin, Some(source), Some(embedding.as_slice()), None);
@@ -42,7 +44,7 @@ fn main() {
     println!("3. wrong source text          -> {:?}", r);
 
     // 4. wrong signing key (rogue signer with same kid as legit)
-    let rogue = Signer::generate("demo-2026-05".to_string());
+    let rogue = Signer::generate("demo-2026-05".to_string()).expect("test signer generate");
     let rogue_pin = rogue
         .pin(source, "m", embedding.as_slice())
         .expect("rogue pin");
diff --git a/rust/vectorpin/src/lib.rs b/rust/vectorpin/src/lib.rs
index 7e4d464..025065f 100644
--- a/rust/vectorpin/src/lib.rs
+++ b/rust/vectorpin/src/lib.rs
@@ -30,7 +30,7 @@
 //! use vectorpin::{Signer, Verifier};
 //!
 //! // Ingestion: produce an embedding, sign a pin for it.
-//! let signer = Signer::generate("prod-2026-05".to_string());
+//! let signer = Signer::generate("prod-2026-05".to_string()).expect("generate signer");
 //! let embedding: Vec<f32> = vec![0.1, 0.2, 0.3, /* ... */];
 //! let pin = signer
 //!     .pin("The quick brown fox.", "text-embedding-3-large", embedding.as_slice())
@@ -42,7 +42,9 @@
 //! // Read/audit: parse the stored JSON and verify against ground truth.
 //! let parsed = vectorpin::Pin::from_json(&stored).expect("parse pin");
 //! let mut verifier = Verifier::new();
-//! verifier.add_key(signer.key_id(), signer.public_key_bytes());
+//! verifier
+//!     .add_key(signer.key_id(), signer.public_key_bytes())
+//!     .expect("valid pubkey");
 //!
 //! let result = verifier.verify_full(
 //!     &parsed,
@@ -124,6 +126,7 @@
 //! defeat, see the companion preprint at
 //! [10.5281/zenodo.20058256](https://doi.org/10.5281/zenodo.20058256).
 
+#![forbid(unsafe_code)]
 #![warn(missing_docs)]
 #![warn(rust_2018_idioms)]
 #![warn(rustdoc::broken_intra_doc_links)]
diff --git a/rust/vectorpin/src/signer.rs b/rust/vectorpin/src/signer.rs
index 893a85e..aa4692c 100644
--- a/rust/vectorpin/src/signer.rs
+++ b/rust/vectorpin/src/signer.rs
@@ -21,6 +21,7 @@ use std::collections::BTreeMap;
 
 use ed25519_dalek::{Signer as _, SigningKey, VerifyingKey};
 use unicode_normalization::UnicodeNormalization;
+use zeroize::Zeroizing;
 
 use crate::attestation::{
     check_nfc, check_string_safe, AttestationError, Pin, PinHeader, PROTOCOL_VERSION,
@@ -53,20 +54,23 @@ pub struct Signer {
 impl Signer {
     /// Generate a fresh Ed25519 signer. Tests and demos only.
     ///
-    /// Panics if `key_id` is empty (the API for new pins requires a kid
-    /// — tests are the only generation path and a panic is acceptable
-    /// there).
-    pub fn generate(key_id: String) -> Self {
-        assert!(!key_id.is_empty(), "key_id must be non-empty");
+    /// Returns `Err(SignerError::EmptyKeyId)` if `key_id` is empty, or
+    /// the underlying validation error if `key_id` is not NFC or
+    /// contains control characters / bidi overrides. Use a KMS-backed
+    /// signer for production.
+    pub fn generate(key_id: String) -> Result<Self, SignerError> {
+        if key_id.is_empty() {
+            return Err(SignerError::EmptyKeyId);
+        }
         // Validate the kid against v2 string rules so a generated signer
         // can never produce a pin a strict verifier would reject.
-        check_string_safe(&key_id, "key_id").expect("key_id contains unsafe chars");
-        check_nfc(&key_id, "key_id").expect("key_id is not NFC");
+        check_string_safe(&key_id, "key_id").map_err(SignerError::InvalidString)?;
+        check_nfc(&key_id, "key_id").map_err(SignerError::InvalidString)?;
         let mut rng = rand::rngs::OsRng;
-        Signer {
+        Ok(Signer {
             signing_key: SigningKey::generate(&mut rng),
             key_id,
-        }
+        })
     }
 
     /// Load a signer from a 32-byte raw Ed25519 private seed.
@@ -95,9 +99,10 @@ impl Signer {
         VerifyingKey::from(&self.signing_key).to_bytes()
     }
 
-    /// 32-byte raw Ed25519 private seed. Treat as a secret.
-    pub fn private_key_bytes(&self) -> [u8; 32] {
-        self.signing_key.to_bytes()
+    /// 32-byte raw Ed25519 private seed, wrapped in [`Zeroizing`] so the
+    /// caller's copy is wiped on drop. Treat as a high-value secret.
+    pub fn private_key_bytes(&self) -> Zeroizing<[u8; 32]> {
+        Zeroizing::new(self.signing_key.to_bytes())
     }
 
     /// Create a [`Pin`] for `(source, model, vector)`.
@@ -164,6 +169,8 @@ impl Signer {
         check_string_safe(&ts, "ts")?;
         check_nfc(&ts, "ts")?;
 
+        let vec_dim = u32::try_from(vector.len())
+            .map_err(|_| SignerError::InvalidVector("vec_dim exceeds u32".into()))?;
         let header = PinHeader {
             v: PROTOCOL_VERSION,
             kid: self.key_id.clone(),
@@ -172,7 +179,7 @@ impl Signer {
             source_hash: hash_text(&source_nfc),
             vec_hash: hash_vector(vector, dtype),
             vec_dtype: dtype.as_str().to_owned(),
-            vec_dim: vector.len() as u32,
+            vec_dim,
             ts,
             extra: extra_nfc,
         };
@@ -243,7 +250,7 @@ mod tests {
 
     #[test]
     fn pin_round_trip_basic() {
-        let signer = Signer::generate("test".into());
+        let signer = Signer::generate("test".into()).expect("test signer generate");
         let v: Vec<f32> = vec![1.0, 2.0, 3.0];
         let pin = signer.pin("hello", "model", v.as_slice()).unwrap();
         assert_eq!(pin.kid(), "test");
@@ -267,7 +274,7 @@ mod tests {
 
     #[test]
     fn signer_rejects_nan() {
-        let signer = Signer::generate("k".into());
+        let signer = Signer::generate("k".into()).expect("test signer generate");
         let v: Vec<f32> = vec![1.0, f32::NAN, 3.0];
         let err = signer.pin("x", "m", v.as_slice()).unwrap_err();
         assert!(matches!(err, SignerError::InvalidVector(_)));
@@ -275,7 +282,7 @@ mod tests {
 
     #[test]
     fn signer_rejects_infinity() {
-        let signer = Signer::generate("k".into());
+        let signer = Signer::generate("k".into()).expect("test signer generate");
         let v: Vec<f64> = vec![1.0, f64::INFINITY];
         let err = signer.pin("x", "m", v.as_slice()).unwrap_err();
         assert!(matches!(err, SignerError::InvalidVector(_)));
diff --git a/rust/vectorpin/src/verifier.rs b/rust/vectorpin/src/verifier.rs
index 6eb9750..b9a45da 100644
--- a/rust/vectorpin/src/verifier.rs
+++ b/rust/vectorpin/src/verifier.rs
@@ -62,6 +62,10 @@ pub enum VerifyError {
     TenantMismatch,
     /// Pin's `vec_dtype` is not understood by this build.
     UnsupportedDtype(String),
+    /// Public key bytes provided to `add_key` did not decode to a valid
+    /// Edwards point. The registration was refused rather than silently
+    /// dropped, so callers can detect bad key material at setup time.
+    KeyDecodeFailed(String),
 }
 
 impl std::fmt::Display for VerifyError {
@@ -90,6 +94,9 @@ impl std::fmt::Display for VerifyError {
             VerifyError::CollectionMismatch => write!(f, "vectorpin.collection_id mismatch"),
             VerifyError::TenantMismatch => write!(f, "vectorpin.tenant_id mismatch"),
             VerifyError::UnsupportedDtype(s) => write!(f, "unsupported canonical dtype: {s}"),
+            VerifyError::KeyDecodeFailed(kid) => {
+                write!(f, "public key for kid {kid:?} failed to decode")
+            }
         }
     }
 }
@@ -185,10 +192,11 @@ impl Verifier {
     }
 
     /// Register a public key under `kid` with no validity window.
-    pub fn add_key(&mut self, kid: &str, public_key_bytes: [u8; 32]) {
-        if let Ok(vk) = VerifyingKey::from_bytes(&public_key_bytes) {
-            self.keys.insert(kid.to_owned(), KeyEntry::new(vk));
-        }
+    pub fn add_key(&mut self, kid: &str, public_key_bytes: [u8; 32]) -> Result<(), VerifyError> {
+        let vk = VerifyingKey::from_bytes(&public_key_bytes)
+            .map_err(|_| VerifyError::KeyDecodeFailed(kid.to_owned()))?;
+        self.keys.insert(kid.to_owned(), KeyEntry::new(vk));
+        Ok(())
     }
 
     /// Register a fully-specified [`KeyEntry`] under `kid`.
@@ -287,7 +295,8 @@ impl Verifier {
 
         // Step 6: vector check.
         if let Some(vec) = opts.vector {
-            if vec.len() as u32 != pin.header.vec_dim {
+            let supplied_dim = u32::try_from(vec.len()).unwrap_or(u32::MAX);
+            if supplied_dim != pin.header.vec_dim {
                 return Err(VerifyError::ShapeMismatch {
                     supplied: vec.len(),
                     expected: pin.header.vec_dim,
@@ -376,8 +385,8 @@ impl LegacyV1Verifier {
     }
 
     /// Forwarded: register a public key.
-    pub fn add_key(&mut self, kid: &str, public_key_bytes: [u8; 32]) {
-        self.inner.add_key(kid, public_key_bytes);
+    pub fn add_key(&mut self, kid: &str, public_key_bytes: [u8; 32]) -> Result<(), VerifyError> {
+        self.inner.add_key(kid, public_key_bytes)
     }
 
     /// Forwarded: register a [`KeyEntry`] with optional validity window.
@@ -492,9 +501,11 @@ mod tests {
     use crate::signer::Signer;
 
     fn fixture(kid: &str) -> (Signer, Verifier, Vec<f32>) {
-        let signer = Signer::generate(kid.into());
+        let signer = Signer::generate(kid.into()).expect("test signer generate");
         let mut verifier = Verifier::new();
-        verifier.add_key(signer.key_id(), signer.public_key_bytes());
+        verifier
+            .add_key(signer.key_id(), signer.public_key_bytes())
+            .unwrap();
         let v: Vec<f32> = (0..16).map(|i| (i as f32) * 0.1).collect();
         (signer, verifier, v)
     }
@@ -532,12 +543,14 @@ mod tests {
 
     #[test]
     fn unknown_key_is_caught() {
-        let signer = Signer::generate("rogue".into());
+        let signer = Signer::generate("rogue".into()).expect("test signer generate");
         let v: Vec<f32> = vec![1.0, 2.0, 3.0];
         let pin = signer.pin("x", "m", v.as_slice()).unwrap();
-        let other = Signer::generate("prod".into());
+        let other = Signer::generate("prod".into()).expect("test signer generate");
         let mut verifier = Verifier::new();
-        verifier.add_key(other.key_id(), other.public_key_bytes());
+        verifier
+            .add_key(other.key_id(), other.public_key_bytes())
+            .unwrap();
         let err = verifier.verify_signature(&pin).unwrap_err();
         assert!(matches!(err, VerifyError::UnknownKey(_)));
     }
@@ -564,7 +577,7 @@ mod tests {
 
     #[test]
     fn key_expired_lower_bound() {
-        let signer = Signer::generate("k".into());
+        let signer = Signer::generate("k".into()).expect("test signer generate");
         let v: Vec<f32> = vec![1.0, 2.0];
         let pin = signer.pin("x", "m", v.as_slice()).unwrap();
         let pin_unix = parse_v2_ts_unix(&pin.header.ts).unwrap();
diff --git a/rust/vectorpin/tests/cross_lang.rs b/rust/vectorpin/tests/cross_lang.rs
index afda9e2..efd637d 100644
--- a/rust/vectorpin/tests/cross_lang.rs
+++ b/rust/vectorpin/tests/cross_lang.rs
@@ -166,7 +166,9 @@ fn run_v2_fixture(bundle: &V2Bundle, fx: &V2Fixture) {
     // Round-trip and verify.
     let parsed = Pin::from_json(&pin.to_json()).expect("rust parses its own JSON");
     let mut verifier = Verifier::new();
-    verifier.add_key(&bundle.key_id, signer.public_key_bytes());
+    verifier
+        .add_key(&bundle.key_id, signer.public_key_bytes())
+        .unwrap();
     verifier
         .verify_full::<&[f32]>(&parsed, Some(&fx.input.source), None, None)
         .expect("rust verifies own pin");
@@ -235,6 +237,7 @@ fn classify(err: &VerifyError) -> &'static str {
         VerifyError::CollectionMismatch => "COLLECTION_MISMATCH",
         VerifyError::TenantMismatch => "TENANT_MISMATCH",
         VerifyError::UnsupportedDtype(_) => "PARSE_ERROR",
+        VerifyError::KeyDecodeFailed(_) => "UNKNOWN_KEY",
     }
 }
 
@@ -247,7 +250,7 @@ fn run_negative(bundle: &V2NegativeBundle, fx: &V2NegativeFixture) {
     let pk: [u8; 32] = b64(&bundle.public_key_b64)
         .try_into()
         .expect("public key 32 bytes");
-    verifier.add_key(&bundle.key_id, pk);
+    verifier.add_key(&bundle.key_id, pk).unwrap();
 
     // The pin may fail to parse — that itself is a PARSE_ERROR outcome.
     let parsed = match Pin::from_json(&fx.pin_json) {
diff --git a/rust/vectorpin/tests/hardening.rs b/rust/vectorpin/tests/hardening.rs
new file mode 100644
index 0000000..bba9f59
--- /dev/null
+++ b/rust/vectorpin/tests/hardening.rs
@@ -0,0 +1,179 @@
+// Copyright 2025 Jascha Wanger / Tarnover, LLC
+// SPDX-License-Identifier: Apache-2.0
+
+//! Regression tests for the `security/p2-hardening` branch.
+//!
+//! Each test pins a single behavioural contract introduced or tightened
+//! by that branch so the hardening cannot silently regress.
+//!
+//! Wire-format / canonicalization changes belong to a separate branch
+//! and are deliberately not exercised here.
+
+use vectorpin::attestation::AttestationError;
+use vectorpin::{Pin, Signer, SignerError, Verifier, VerifyError};
+use zeroize::Zeroizing;
+
+// --- 1. `private_key_bytes` returns a `Zeroizing` wrapper. ---------------
+
+#[test]
+fn private_key_bytes_is_zeroizing() {
+    let signer = Signer::generate("kid".into()).expect("non-empty kid");
+    // Compile-time check on the return type: this binding only compiles
+    // if `private_key_bytes` actually returns `Zeroizing<[u8; 32]>`.
+    let seed: Zeroizing<[u8; 32]> = signer.private_key_bytes();
+    // And the buffer is still usable as a `[u8; 32]` via deref.
+    let _bytes: &[u8; 32] = &seed;
+    assert_eq!(seed.len(), 32);
+}
+
+// --- 2. `Signer::generate` returns `Result` on empty kid. ----------------
+
+#[test]
+fn signer_generate_rejects_empty_kid() {
+    let res = Signer::generate(String::new());
+    assert!(
+        matches!(res, Err(SignerError::EmptyKeyId)),
+        "expected EmptyKeyId, got {:?}",
+        res.err()
+    );
+}
+
+#[test]
+fn signer_generate_accepts_non_empty_kid() {
+    let res = Signer::generate("k".into());
+    assert!(res.is_ok());
+}
+
+// --- 3. `Verifier::add_key` rejects malformed public keys. ---------------
+
+#[test]
+fn verifier_add_key_rejects_invalid_public_key() {
+    // Note: many "obviously bad" 32-byte buffers — all-zeros, all-0xff —
+    // are *not* rejected by ed25519-dalek's `from_bytes` (e.g. all-zero
+    // decompresses to a low-order point, and 0xff repeated still gives
+    // a decodable y). The buffer below is a y-coordinate whose
+    // `y^2 - 1 / (d * y^2 + 1)` is a non-residue, so decompression
+    // genuinely fails. Confirmed empirically against ed25519-dalek 2.x.
+    let mut bad = [0u8; 32];
+    bad[0] = 0x02;
+    let mut verifier = Verifier::new();
+    let res = verifier.add_key("kid", bad);
+    assert!(
+        matches!(res, Err(VerifyError::KeyDecodeFailed(_))),
+        "expected KeyDecodeFailed, got {:?}",
+        res
+    );
+    assert_eq!(
+        verifier.key_count(),
+        0,
+        "rejected key must not be registered"
+    );
+}
+
+#[test]
+fn verifier_add_key_accepts_valid_public_key() {
+    let signer = Signer::generate("kid".into()).unwrap();
+    let mut verifier = Verifier::new();
+    verifier
+        .add_key("kid", signer.public_key_bytes())
+        .expect("valid pubkey");
+    assert_eq!(verifier.key_count(), 1);
+}
+
+// --- 4. `Pin::from_json` rejects non-string `extra` values. --------------
+
+#[test]
+fn pin_from_json_rejects_non_string_extra_value() {
+    // Hand-built JSON whose `extra` map has a numeric value (1) under
+    // the key "k". The previous implementation silently dropped this
+    // entry; the new contract is a hard error.
+    let bad = serde_json::json!({
+        "v": 2,
+        "model": "m",
+        "source_hash": format!("sha256:{}", "0".repeat(64)),
+        "vec_hash": format!("sha256:{}", "1".repeat(64)),
+        "vec_dtype": "f32",
+        "vec_dim": 1,
+        "ts": "2026-05-05T12:00:00Z",
+        "extra": {"k": 1},
+        "kid": "k",
+        "sig": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
+    });
+    let res = Pin::from_value(bad);
+    assert!(
+        matches!(&res, Err(AttestationError::InvalidField { field, .. }) if field.starts_with("extra")),
+        "expected InvalidField with field starting with 'extra', got {:?}",
+        res
+    );
+}
+
+#[test]
+fn pin_from_json_accepts_string_extra_value() {
+    // Build a real signed pin with a string-valued `extra` entry and
+    // confirm it round-trips through the parser. The structural-validity
+    // checks (v == 2, kid, sig length, hashes) are all satisfied by
+    // routing through the real signer.
+    use std::collections::BTreeMap;
+    use vectorpin::signer::PinOptions;
+    let signer = Signer::generate("k".into()).unwrap();
+    let v: Vec<f32> = vec![1.0, 2.0, 3.0];
+    let mut extra = BTreeMap::new();
+    extra.insert("k".to_owned(), "v".to_owned());
+    let opts = PinOptions {
+        extra,
+        ..PinOptions::default()
+    };
+    let pin = signer
+        .pin_with_options("hello", "m", v.as_slice(), opts)
+        .unwrap();
+    let wire = pin.to_json();
+    let round = Pin::from_json(&wire).expect("string-valued extra round-trips");
+    assert_eq!(round.header.extra.get("k").map(String::as_str), Some("v"));
+}
+
+// --- 5. `Pin::from_json` rejects trailing garbage after the JSON object.
+//
+// Contract: `Pin::from_json` accepts exactly one JSON value followed by
+// nothing but whitespace. A NUL byte (or any other non-whitespace) after
+// the closing brace must surface as an error rather than being silently
+// truncated. This protects callers that store pins in length-prefixed
+// blobs where a framing bug could otherwise let an attacker append data
+// after the legitimate JSON without breaking parse.
+
+#[test]
+fn pin_from_json_rejects_trailing_garbage() {
+    let signer = Signer::generate("k".into()).unwrap();
+    let v: Vec<f32> = vec![1.0, 2.0, 3.0];
+    let pin = signer.pin("hello", "m", v.as_slice()).unwrap();
+    let mut wire = pin.to_json();
+    wire.push('\u{0000}');
+    wire.push_str("trailing");
+    let res = Pin::from_json(&wire);
+    assert!(
+        res.is_err(),
+        "trailing garbage after valid JSON must be rejected, got Ok"
+    );
+}
+
+// --- 6. Oversize vectors surface as `InvalidVector`, not silent truncation.
+//
+// We can't realistically allocate a > u32::MAX-element slice in a unit
+// test, so the cast itself is exercised via the boundary helper below.
+// What we *can* do cheaply is round-trip a normal pin through the
+// checked-cast code path to confirm the happy path still works after
+// the signature changed.
+
+#[test]
+fn pin_normal_dim_still_round_trips_after_checked_cast() {
+    let signer = Signer::generate("k".into()).unwrap();
+    let v: Vec<f32> = vec![0.5; 1024];
+    let pin = signer.pin("hello", "m", v.as_slice()).unwrap();
+    assert_eq!(pin.header.vec_dim, 1024);
+    let mut verifier = Verifier::new();
+    verifier
+        .add_key(signer.key_id(), signer.public_key_bytes())
+        .unwrap();
+    verifier
+        .verify_full(&pin, Some("hello"), Some(v.as_slice()), None)
+        .unwrap();
+}
diff --git a/rust/vectorpin/tests/legacy_v1.rs b/rust/vectorpin/tests/legacy_v1.rs
index 9960506..52d419d 100644
--- a/rust/vectorpin/tests/legacy_v1.rs
+++ b/rust/vectorpin/tests/legacy_v1.rs
@@ -74,10 +74,12 @@ fn default_v2_verifier_rejects_v1_fixtures() {
 
     // Strict v2 verifier must NOT accept v1 — confirms wire-format break.
     let mut verifier = Verifier::new();
-    verifier.add_key(
-        &bundle.key_id,
-        b64(&bundle.public_key_b64).try_into().unwrap(),
-    );
+    verifier
+        .add_key(
+            &bundle.key_id,
+            b64(&bundle.public_key_b64).try_into().unwrap(),
+        )
+        .unwrap();
 
     for fx in &bundle.fixtures {
         // The strict parser rejects v1 pins outright, before reaching
diff --git a/rust/vectorpin/tests/v2_canonicalization.rs b/rust/vectorpin/tests/v2_canonicalization.rs
index 34bbbe0..8df8a11 100644
--- a/rust/vectorpin/tests/v2_canonicalization.rs
+++ b/rust/vectorpin/tests/v2_canonicalization.rs
@@ -10,7 +10,7 @@ use vectorpin::{
 };
 
 fn v2_signer(kid: &str) -> Signer {
-    Signer::generate(kid.into())
+    Signer::generate(kid.into()).expect("test signer generate")
 }
 
 fn small_vec() -> Vec<f32> {
@@ -45,7 +45,9 @@ fn kid_is_in_signed_bytes() {
     tampered.header.kid = "kid-b".into();
 
     let mut verifier = Verifier::new();
-    verifier.add_key("kid-b", signer.public_key_bytes());
+    verifier
+        .add_key("kid-b", signer.public_key_bytes())
+        .unwrap();
     let err = verifier.verify_signature(&tampered).unwrap_err();
     assert_eq!(err, VerifyError::SignatureInvalid);
 }
@@ -59,7 +61,7 @@ fn v_is_in_signed_bytes() {
     let mut tampered = pin.clone();
     tampered.header.v = 99;
     let mut verifier = Verifier::new();
-    verifier.add_key("k1", signer.public_key_bytes());
+    verifier.add_key("k1", signer.public_key_bytes()).unwrap();
     let err = verifier.verify_signature(&tampered).unwrap_err();
     // Unsupported version is rejected before reaching signature, but in
     // either case the pin must NOT verify.
@@ -254,7 +256,9 @@ fn verify_nan_vector_rejected_as_parse_error() {
     let pin = signer.pin("x", "m", v.as_slice()).unwrap();
 
     let mut verifier = Verifier::new();
-    verifier.add_key(signer.key_id(), signer.public_key_bytes());
+    verifier
+        .add_key(signer.key_id(), signer.public_key_bytes())
+        .unwrap();
 
     let mut nan_vec = v.clone();
     nan_vec[0] = f32::NAN;
@@ -289,7 +293,9 @@ fn round_trip_with_extra_and_model_hash() {
     assert_eq!(parsed, pin);
 
     let mut verifier = Verifier::new();
-    verifier.add_key(signer.key_id(), signer.public_key_bytes());
+    verifier
+        .add_key(signer.key_id(), signer.public_key_bytes())
+        .unwrap();
     verifier
         .verify(
             &parsed,
diff --git a/src/vectorpin/adapters/lancedb.py b/src/vectorpin/adapters/lancedb.py
index b6c626e..e76dcd3 100644
--- a/src/vectorpin/adapters/lancedb.py
+++ b/src/vectorpin/adapters/lancedb.py
@@ -17,6 +17,7 @@
 
 from __future__ import annotations
 
+import re
 from collections.abc import Iterator
 from typing import Any
 
@@ -30,6 +31,37 @@
 DEFAULT_ID_COLUMN = "id"
 DEFAULT_VECTOR_COLUMN = "vector"
 
+# Column names get inlined into SQL predicates without quoting, so the
+# allow-list has to be airtight. Standard SQL identifier shape only.
+_IDENT_RE = re.compile(r"^[A-Za-z_][A-Za-z0-9_]*$")
+
+
+def _validate_column_name(col: str, *, field: str = "id_column") -> str:
+    """Reject column names that aren't safe to embed in a SQL predicate.
+
+    LanceDB's `where` clauses are SQL expressions parsed by DataFusion,
+    so a column name with whitespace, quotes, or punctuation could
+    inject syntax. We only accept the standard identifier shape.
+    """
+    if not isinstance(col, str) or not _IDENT_RE.match(col):
+        raise ValueError(f"invalid {field}: {col!r}")
+    return col
+
+
+def _validate_record_id(rid: str) -> str:
+    """Reject record ids with control chars that the SQL escaper won't catch.
+
+    Single-quote escaping handles SQL string literals, but a backslash
+    or embedded NUL/newline can still confuse downstream consumers and
+    log files. Refuse them at the boundary.
+    """
+    if not isinstance(rid, str):
+        raise ValueError(f"record_id must be str; got {type(rid).__name__}")
+    for ch in ("\x00", "\n", "\r", "\\"):
+        if ch in rid:
+            raise ValueError(f"record_id contains forbidden character {ch!r}")
+    return rid
+
 
 class LanceDBAdapter(BaseAdapter):
     """Wraps a LanceDB table for VectorPin reads and writes.
@@ -53,9 +85,11 @@ def __init__(
         pin_column: str = PIN_METADATA_KEY,
     ):
         self._table = table
-        self._id = id_column
-        self._vec = vector_column
-        self._pin = pin_column
+        # Validate every column name we'll ever inline into a SQL
+        # predicate. Cheaper to fail at construction than at query.
+        self._id = _validate_column_name(id_column, field="id_column")
+        self._vec = _validate_column_name(vector_column, field="vector_column")
+        self._pin = _validate_column_name(pin_column, field="pin_column")
 
     @classmethod
     def connect(
@@ -167,7 +201,11 @@ def _id_predicate(column: str, record_id: str) -> str:
 
     Lance's where-clause is a SQL expression evaluated by DataFusion.
     We escape single quotes by doubling them, which is the canonical
-    SQL string-literal escape and what DataFusion expects.
+    SQL string-literal escape and what DataFusion expects. The column
+    name and id are also validated up front against control chars and
+    non-identifier shapes so this string interpolation is safe.
     """
+    _validate_column_name(column, field="id_column")
+    _validate_record_id(record_id)
     escaped = record_id.replace("'", "''")
     return f"{column} = '{escaped}'"
diff --git a/src/vectorpin/adapters/pinecone.py b/src/vectorpin/adapters/pinecone.py
index 1ea1fa8..8f24eb1 100644
--- a/src/vectorpin/adapters/pinecone.py
+++ b/src/vectorpin/adapters/pinecone.py
@@ -18,8 +18,10 @@
 
 from __future__ import annotations
 
+import os
 from collections.abc import Iterator
 from typing import TYPE_CHECKING, Any
+from urllib.parse import urlparse
 
 import numpy as np
 
@@ -30,6 +32,45 @@
     from pinecone import Index
 
 
+_LOOPBACK_HOSTS = frozenset({"localhost", "127.0.0.1", "::1"})
+
+
+def _is_loopback(host: str | None) -> bool:
+    if not host:
+        return False
+    h = host.strip("[]").lower()
+    if h in _LOOPBACK_HOSTS:
+        return True
+    return h.startswith("127.")
+
+
+def _enforce_tls_host(host: str | None, api_key: str | None) -> None:
+    """Refuse plaintext HTTP when an api_key is present.
+
+    Pinecone's `host` may be a bare hostname (recommended) or a full
+    URL. Only the URL form lets us see a scheme; if a scheme is set to
+    http and the host isn't loopback we treat that as misconfiguration.
+    Set VECTORPIN_ALLOW_INSECURE_HTTP=1 to override.
+    """
+    if not host or not api_key:
+        return
+    parsed = urlparse(host)
+    # `urlparse("example.com")` gives scheme="" and netloc="" — nothing
+    # to validate against, fall through.
+    if not parsed.scheme:
+        return
+    if parsed.scheme != "http":
+        return
+    if _is_loopback(parsed.hostname):
+        return
+    if os.environ.get("VECTORPIN_ALLOW_INSECURE_HTTP") == "1":
+        return
+    raise ValueError(
+        "api_key with non-TLS URL refused "
+        "(set VECTORPIN_ALLOW_INSECURE_HTTP=1 if you know what you're doing)"
+    )
+
+
 class PineconeAdapter(BaseAdapter):
     """Wraps a Pinecone index for VectorPin reads and writes."""
 
@@ -51,7 +92,13 @@ def connect(
         `host` is optional but recommended for production: passing
         the dedicated index host skips a control-plane lookup on
         every connection.
+
+        If `host` is provided as a URL with scheme `http://`, we refuse
+        the connection unless the host is loopback. Set the env var
+        `VECTORPIN_ALLOW_INSECURE_HTTP=1` to override; this exists for
+        cases where transport security is enforced out-of-band.
         """
+        _enforce_tls_host(host, api_key)
         try:
             from pinecone import Pinecone
         except ImportError as e:
diff --git a/src/vectorpin/adapters/qdrant.py b/src/vectorpin/adapters/qdrant.py
index 2d9dde7..5aa3f5c 100644
--- a/src/vectorpin/adapters/qdrant.py
+++ b/src/vectorpin/adapters/qdrant.py
@@ -11,8 +11,10 @@
 
 from __future__ import annotations
 
+import os
 from collections.abc import Iterator
 from typing import TYPE_CHECKING, Any
+from urllib.parse import urlparse
 
 import numpy as np
 
@@ -23,6 +25,44 @@
     from qdrant_client import QdrantClient
 
 
+# Hostnames we consider safe to use over plain HTTP with an api_key.
+# Anything else with a real api_key over plaintext leaks the credential.
+_LOOPBACK_HOSTS = frozenset({"localhost", "127.0.0.1", "::1"})
+
+
+def _is_loopback(host: str | None) -> bool:
+    if not host:
+        return False
+    h = host.strip("[]").lower()
+    if h in _LOOPBACK_HOSTS:
+        return True
+    # 127.0.0.0/8 — common docker-compose / k8s patterns.
+    return h.startswith("127.")
+
+
+def _enforce_tls(url: str, api_key: str | None) -> None:
+    """Refuse to send an api_key over plaintext to a non-loopback host.
+
+    Operators who genuinely need plaintext (e.g. in-cluster traffic over
+    a trusted overlay) can set VECTORPIN_ALLOW_INSECURE_HTTP=1 to opt
+    out. The env-var escape hatch is intentionally environment-scoped
+    so it can't be set accidentally in a single CLI invocation.
+    """
+    if not api_key:
+        return
+    parsed = urlparse(url)
+    if parsed.scheme != "http":
+        return
+    if _is_loopback(parsed.hostname):
+        return
+    if os.environ.get("VECTORPIN_ALLOW_INSECURE_HTTP") == "1":
+        return
+    raise ValueError(
+        "api_key with non-TLS URL refused "
+        "(set VECTORPIN_ALLOW_INSECURE_HTTP=1 if you know what you're doing)"
+    )
+
+
 class QdrantAdapter(BaseAdapter):
     """Wraps a Qdrant collection for VectorPin reads and writes."""
 
@@ -38,7 +78,14 @@ def connect(
         *,
         api_key: str | None = None,
     ) -> QdrantAdapter:
-        """Construct an adapter against a remote Qdrant instance."""
+        """Construct an adapter against a remote Qdrant instance.
+
+        If `api_key` is set, the URL must use HTTPS or point at a
+        loopback host; otherwise the credential would travel in cleartext.
+        Set the env var `VECTORPIN_ALLOW_INSECURE_HTTP=1` to override
+        when you have explicit transport-layer protection elsewhere.
+        """
+        _enforce_tls(url, api_key)
         try:
             from qdrant_client import QdrantClient
         except ImportError as e:
diff --git a/src/vectorpin/cli.py b/src/vectorpin/cli.py
index d1ba978..59f799a 100644
--- a/src/vectorpin/cli.py
+++ b/src/vectorpin/cli.py
@@ -17,6 +17,7 @@
 
 import argparse
 import json
+import os
 import sys
 from collections.abc import Iterator
 from pathlib import Path
@@ -30,14 +31,41 @@
     from vectorpin.adapters.base import PinnedRecord
 
 
+def _write_private_key(path: Path, data: bytes) -> None:
+    """Write a private key with mode 0600 atomically.
+
+    Uses O_EXCL so we never silently clobber an existing key on disk —
+    overwriting key material is almost always a bug, and a fresh keygen
+    against a populated directory should fail loudly.
+    """
+    flags = os.O_WRONLY | os.O_CREAT | os.O_EXCL
+    try:
+        fd = os.open(str(path), flags, 0o600)
+    except FileExistsError as e:
+        raise FileExistsError(
+            f"refusing to overwrite existing private key at {path}"
+        ) from e
+    try:
+        os.write(fd, data)
+    finally:
+        os.close(fd)
+
+
 def _cmd_keygen(args: argparse.Namespace) -> int:
     signer = Signer.generate(key_id=args.key_id)
     out = Path(args.output)
-    out.mkdir(parents=True, exist_ok=True)
-    (out / f"{args.key_id}.priv").write_bytes(signer.private_key_bytes())
-    (out / f"{args.key_id}.pub").write_bytes(signer.public_key_bytes())
-    print(f"wrote {out}/{args.key_id}.priv  (KEEP SECRET)", file=sys.stderr)
-    print(f"wrote {out}/{args.key_id}.pub")
+    # mkdir with restrictive mode; if the directory already exists we
+    # leave its mode alone (operator's call) but tighten new dirs.
+    out.mkdir(parents=True, exist_ok=True, mode=0o700)
+    priv_path = out / f"{args.key_id}.priv"
+    pub_path = out / f"{args.key_id}.pub"
+    _write_private_key(priv_path, signer.private_key_bytes())
+    pub_path.write_bytes(signer.public_key_bytes())
+    # Public key is intentionally world-readable, but be explicit so we
+    # don't inherit a surprising umask.
+    os.chmod(pub_path, 0o644)
+    print(f"wrote {priv_path}  (KEEP SECRET)", file=sys.stderr)
+    print(f"wrote {pub_path}")
     return 0
 
 
@@ -90,7 +118,24 @@ def _audit_loop(
     can grep `unpinned` from the JSON summary in CI.
     """
     total = pinned = ok = bad = unpinned = 0
-    for rec in records:
+    # Drive the iterator manually so a malformed record (e.g. a Pin
+    # whose JSON fails strict validation) raises during `next()` and we
+    # can fail-open on that single row instead of aborting the audit.
+    iterator = iter(records)
+    while True:
+        try:
+            rec = next(iterator)
+        except StopIteration:
+            break
+        except (ValueError, json.JSONDecodeError, KeyError) as e:
+            total += 1
+            bad += 1
+            print(
+                f"FAIL <unknown> [parse_error] {e}",
+                file=sys.stderr,
+            )
+            continue
+
         total += 1
         if rec.pin is None:
             unpinned += 1
@@ -108,7 +153,12 @@ def _audit_loop(
                 )
                 continue
             verify_kwargs["source"] = str(src)
-        result = verifier.verify(rec.pin, **verify_kwargs)  # type: ignore[arg-type]
+        try:
+            result = verifier.verify(rec.pin, **verify_kwargs)  # type: ignore[arg-type]
+        except (ValueError, KeyError) as e:
+            bad += 1
+            print(f"FAIL {rec.id} [parse_error] {e}", file=sys.stderr)
+            continue
         if result.ok:
             ok += 1
         else:
diff --git a/tests/test_cli_keygen_perms.py b/tests/test_cli_keygen_perms.py
new file mode 100644
index 0000000..c769478
--- /dev/null
+++ b/tests/test_cli_keygen_perms.py
@@ -0,0 +1,67 @@
+# Copyright 2025 Jascha Wanger / Tarnover, LLC
+# SPDX-License-Identifier: Apache-2.0
+"""Tests for `vectorpin keygen` filesystem permission hardening.
+
+The private key file must land at 0600 regardless of umask, and the
+command must refuse to clobber an existing key. The public key is set
+to 0644 explicitly.
+"""
+
+from __future__ import annotations
+
+import io
+import os
+import stat
+from contextlib import redirect_stderr, redirect_stdout
+from pathlib import Path
+
+import pytest
+
+from vectorpin.cli import build_parser
+
+
+def _run_cli(argv: list[str]) -> tuple[int, str, str]:
+    out = io.StringIO()
+    err = io.StringIO()
+    with redirect_stdout(out), redirect_stderr(err):
+        try:
+            args = build_parser().parse_args(argv)
+            code = int(args.func(args))
+        except SystemExit as e:
+            code = int(e.code) if isinstance(e.code, int) else 1
+    return code, out.getvalue(), err.getvalue()
+
+
+def test_keygen_private_key_is_mode_0600(tmp_path: Path) -> None:
+    """Even with a permissive umask, the .priv file must end up at 0600."""
+    # Force a permissive umask to prove we don't rely on it.
+    prev_umask = os.umask(0o000)
+    try:
+        code, _out, _err = _run_cli(
+            ["keygen", "--key-id", "test-key", "--output", str(tmp_path)]
+        )
+    finally:
+        os.umask(prev_umask)
+
+    assert code == 0
+    priv = tmp_path / "test-key.priv"
+    pub = tmp_path / "test-key.pub"
+    assert priv.exists()
+    assert pub.exists()
+
+    priv_mode = stat.S_IMODE(priv.stat().st_mode)
+    pub_mode = stat.S_IMODE(pub.stat().st_mode)
+    assert oct(priv_mode) == "0o600", f"private key mode is {oct(priv_mode)}"
+    assert oct(pub_mode) == "0o644", f"public key mode is {oct(pub_mode)}"
+
+
+def test_keygen_refuses_to_overwrite_existing_private_key(tmp_path: Path) -> None:
+    """A second keygen against the same directory must fail loudly."""
+    code, _out, _err = _run_cli(
+        ["keygen", "--key-id", "dup", "--output", str(tmp_path)]
+    )
+    assert code == 0
+
+    # Second invocation must raise (not silently clobber).
+    with pytest.raises(FileExistsError):
+        _run_cli(["keygen", "--key-id", "dup", "--output", str(tmp_path)])
diff --git a/tests/test_signer_from_pem.py b/tests/test_signer_from_pem.py
new file mode 100644
index 0000000..9ac1c02
--- /dev/null
+++ b/tests/test_signer_from_pem.py
@@ -0,0 +1,64 @@
+# Copyright 2025 Jascha Wanger / Tarnover, LLC
+# SPDX-License-Identifier: Apache-2.0
+"""Tests for the explicit unencrypted opt-in on Signer.from_pem.
+
+Loading an unencrypted PEM key by default is a footgun (key material
+sitting on disk in cleartext). We require callers to either supply a
+password or pass `allow_unencrypted=True` so the choice is visible at
+the call site.
+"""
+
+from __future__ import annotations
+
+import pytest
+from cryptography.hazmat.primitives import serialization
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
+
+from vectorpin import Signer
+
+
+def _make_unencrypted_pem() -> bytes:
+    """A freshly-generated ed25519 private key in PEM PKCS#8, no password."""
+    key = Ed25519PrivateKey.generate()
+    return key.private_bytes(
+        encoding=serialization.Encoding.PEM,
+        format=serialization.PrivateFormat.PKCS8,
+        encryption_algorithm=serialization.NoEncryption(),
+    )
+
+
+def _make_encrypted_pem(password: bytes) -> bytes:
+    key = Ed25519PrivateKey.generate()
+    return key.private_bytes(
+        encoding=serialization.Encoding.PEM,
+        format=serialization.PrivateFormat.PKCS8,
+        encryption_algorithm=serialization.BestAvailableEncryption(password),
+    )
+
+
+def test_from_pem_refuses_unencrypted_by_default():
+    pem = _make_unencrypted_pem()
+    with pytest.raises(ValueError, match="allow_unencrypted"):
+        Signer.from_pem(pem, key_id="k")
+
+
+def test_from_pem_allows_unencrypted_with_explicit_opt_in():
+    pem = _make_unencrypted_pem()
+    signer = Signer.from_pem(pem, key_id="k", allow_unencrypted=True)
+    assert signer.key_id == "k"
+    assert len(signer.private_key_bytes()) == 32
+
+
+def test_from_pem_with_password_does_not_require_opt_in():
+    password = b"correct horse battery staple"
+    pem = _make_encrypted_pem(password)
+    signer = Signer.from_pem(pem, key_id="k", password=password)
+    assert signer.key_id == "k"
+
+
+def test_from_pem_wrong_password_raises():
+    pem = _make_encrypted_pem(b"right")
+    # cryptography raises ValueError on a wrong password — that's the
+    # contract we care about: bad password is not silently accepted.
+    with pytest.raises(ValueError):
+        Signer.from_pem(pem, key_id="k", password=b"wrong")
diff --git a/typescript/package-lock.json b/typescript/package-lock.json
index 94e2cab..3771f33 100644
--- a/typescript/package-lock.json
+++ b/typescript/package-lock.json
@@ -1,16 +1,16 @@
 {
   "name": "vectorpin",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "vectorpin",
-      "version": "0.1.0",
+      "version": "0.1.1",
       "license": "Apache-2.0",
       "dependencies": {
-        "@noble/ed25519": "^2.1.0",
-        "@noble/hashes": "^1.4.0"
+        "@noble/ed25519": "2.3.0",
+        "@noble/hashes": "1.8.0"
       },
       "devDependencies": {
         "@types/node": "^20.11.0",
diff --git a/typescript/package.json b/typescript/package.json
index 32f61e6..cb4a809 100644
--- a/typescript/package.json
+++ b/typescript/package.json
@@ -43,8 +43,8 @@
     "lint": "tsc -p tsconfig.json --noEmit"
   },
   "dependencies": {
-    "@noble/ed25519": "^2.1.0",
-    "@noble/hashes": "^1.4.0"
+    "@noble/ed25519": "2.3.0",
+    "@noble/hashes": "1.8.0"
   },
   "devDependencies": {
     "@types/node": "^20.11.0",
diff --git a/typescript/test/attestation.test.ts b/typescript/test/attestation.test.ts
new file mode 100644
index 0000000..ce68ede
--- /dev/null
+++ b/typescript/test/attestation.test.ts
@@ -0,0 +1,226 @@
+// Copyright 2025 Jascha Wanger / Tarnover, LLC
+// SPDX-License-Identifier: Apache-2.0
+//
+// Strict-validation tests for pinFromJSON / pinFromDict. These cover
+// the prototype-pollution, size-cap, type, alphabet, and structural
+// checks added in the P2 hardening pass. The positive round-trip is
+// covered in signer-verifier.test.ts and cross-lang.test.ts.
+
+import { describe, it } from 'node:test';
+import { strict as assert } from 'node:assert';
+
+import {
+  MAX_EXTRA_ENTRIES,
+  MAX_PIN_JSON_BYTES,
+  pinFromDict,
+  pinFromJSON,
+  pinToJSON,
+} from '../src/attestation.js';
+import { Signer } from '../src/signer.js';
+
+async function validPinJson(): Promise<string> {
+  const signer = Signer.fromPrivateBytes(new Uint8Array(32).fill(7), 'k1');
+  const pin = await signer.pin({
+    source: 'hello',
+    model: 'm',
+    vector: new Float32Array([0.1, 0.2, 0.3]),
+    timestamp: '2026-05-01T00:00:00Z',
+  });
+  return pinToJSON(pin);
+}
+
+function parseObj(json: string): Record<string, unknown> {
+  return JSON.parse(json) as Record<string, unknown>;
+}
+
+describe('pinFromJSON size cap', () => {
+  it('rejects JSON larger than MAX_PIN_JSON_BYTES', () => {
+    const oversize = '{"x":"' + 'a'.repeat(MAX_PIN_JSON_BYTES) + '"}';
+    assert.throws(() => pinFromJSON(oversize), /maximum size/);
+  });
+
+  it('rejects non-object JSON roots', () => {
+    assert.throws(() => pinFromJSON('123'), /pin JSON root/);
+    assert.throws(() => pinFromJSON('"hi"'), /pin JSON root/);
+    assert.throws(() => pinFromJSON('null'), /pin JSON root/);
+    assert.throws(() => pinFromJSON('[1,2,3]'), /pin JSON root/);
+  });
+});
+
+describe('pinFromDict prototype-pollution guards', () => {
+  it('rejects __proto__ as an own property', async () => {
+    const base = parseObj(await validPinJson());
+    const polluted = JSON.parse(
+      JSON.stringify(base).replace(/^\{/, '{"__proto__":{"polluted":1},'),
+    ) as Record<string, unknown>;
+    assert.ok(Object.prototype.hasOwnProperty.call(polluted, '__proto__'));
+    assert.throws(() => pinFromDict(polluted), /forbidden key/);
+  });
+
+  it('rejects constructor as an own property', async () => {
+    const base = parseObj(await validPinJson());
+    const polluted = { constructor: 'evil', ...base } as Record<string, unknown>;
+    assert.throws(() => pinFromDict(polluted), /forbidden key/);
+  });
+
+  it('rejects prototype as an own property', async () => {
+    const base = parseObj(await validPinJson());
+    const polluted = { prototype: 'evil', ...base } as Record<string, unknown>;
+    assert.throws(() => pinFromDict(polluted), /forbidden key/);
+  });
+
+  it('rejects __proto__ inside extra', async () => {
+    const base = parseObj(await validPinJson());
+    base['extra'] = JSON.parse('{"__proto__":"x"}');
+    assert.throws(() => pinFromDict(base), /forbidden key in pin.extra|unknown pin field/);
+  });
+});
+
+describe('pinFromDict unknown top-level keys', () => {
+  it('rejects unknown keys', async () => {
+    const base = parseObj(await validPinJson());
+    base['surprise'] = 'gotcha';
+    assert.throws(() => pinFromDict(base), /unknown pin field/);
+  });
+});
+
+describe('pinFromDict type checks', () => {
+  it('rejects wrong v', async () => {
+    const base = parseObj(await validPinJson());
+    base['v'] = 99;
+    assert.throws(() => pinFromDict(base), /unsupported pin version/);
+  });
+
+  it('rejects v as a string', async () => {
+    const base = parseObj(await validPinJson());
+    base['v'] = '2';
+    assert.throws(() => pinFromDict(base), /pin\.v must be an integer/);
+  });
+
+  it('rejects empty model', async () => {
+    const base = parseObj(await validPinJson());
+    base['model'] = '';
+    assert.throws(() => pinFromDict(base), /pin.model/);
+  });
+
+  it('rejects non-string kid', async () => {
+    const base = parseObj(await validPinJson());
+    base['kid'] = 42;
+    assert.throws(() => pinFromDict(base), /pin.kid/);
+  });
+
+  it('rejects non-string ts', async () => {
+    const base = parseObj(await validPinJson());
+    base['ts'] = 123456;
+    assert.throws(() => pinFromDict(base), /pin.ts/);
+  });
+
+  it('rejects unknown vec_dtype', async () => {
+    const base = parseObj(await validPinJson());
+    base['vec_dtype'] = 'f16';
+    assert.throws(() => pinFromDict(base), /unsupported vec_dtype/);
+  });
+
+  it('rejects non-integer vec_dim', async () => {
+    const base = parseObj(await validPinJson());
+    base['vec_dim'] = 3.5;
+    assert.throws(() => pinFromDict(base), /vec_dim/);
+  });
+
+  it('rejects zero vec_dim', async () => {
+    const base = parseObj(await validPinJson());
+    base['vec_dim'] = 0;
+    assert.throws(() => pinFromDict(base), /vec_dim/);
+  });
+
+  it('rejects vec_dim above the cap', async () => {
+    const base = parseObj(await validPinJson());
+    base['vec_dim'] = 2_000_000;
+    assert.throws(() => pinFromDict(base), /vec_dim/);
+  });
+});
+
+describe('pinFromDict hash format checks', () => {
+  it('rejects malformed source_hash', async () => {
+    const base = parseObj(await validPinJson());
+    base['source_hash'] = 'sha256:ZZZ';
+    assert.throws(() => pinFromDict(base), /source_hash/);
+  });
+
+  it('rejects malformed vec_hash', async () => {
+    const base = parseObj(await validPinJson());
+    base['vec_hash'] = 'not-a-hash';
+    assert.throws(() => pinFromDict(base), /vec_hash/);
+  });
+
+  it('rejects malformed model_hash when present', async () => {
+    const base = parseObj(await validPinJson());
+    base['model_hash'] = 'sha256:short';
+    assert.throws(() => pinFromDict(base), /model_hash/);
+  });
+
+  it('accepts a well-formed optional model_hash', async () => {
+    const base = parseObj(await validPinJson());
+    base['model_hash'] = 'sha256:' + '0'.repeat(64);
+    // Will still fail on signature length-or-mismatch — but parsing
+    // the pin shape should succeed up to that. We assert the error is
+    // about the signature, not the model_hash.
+    try {
+      pinFromDict(base);
+    } catch (e) {
+      assert.doesNotMatch(String((e as Error).message), /model_hash/);
+    }
+  });
+});
+
+describe('pinFromDict signature checks', () => {
+  it('rejects sig of wrong byte length', async () => {
+    const base = parseObj(await validPinJson());
+    // 8 zero bytes -> 11 base64url chars (no pad).
+    base['sig'] = 'AAAAAAAAAAA';
+    assert.throws(() => pinFromDict(base), /pin.sig must decode to 64 bytes/);
+  });
+
+  it('rejects sig with standard-base64 + or / characters', async () => {
+    const base = parseObj(await validPinJson());
+    // Construct a 64-byte payload that, in standard base64, contains
+    // a '+' or '/'. 0xfb 0xff produces '+/' near the front. We just
+    // splice one in to ensure rejection.
+    base['sig'] = '+'.repeat(86);
+    assert.throws(() => pinFromDict(base), /base64url input/);
+  });
+
+  it('rejects sig with whitespace', async () => {
+    const base = parseObj(await validPinJson());
+    base['sig'] = 'AAAA AAAA';
+    assert.throws(() => pinFromDict(base), /base64url input/);
+  });
+
+  it('rejects missing sig', async () => {
+    const base = parseObj(await validPinJson());
+    delete base['sig'];
+    assert.throws(() => pinFromDict(base), /pin.sig/);
+  });
+});
+
+describe('pinFromDict extra map', () => {
+  it('rejects non-string values', async () => {
+    const base = parseObj(await validPinJson());
+    base['extra'] = { foo: 123 };
+    assert.throws(() => pinFromDict(base), /pin.extra/);
+  });
+
+  it('rejects extra arrays', async () => {
+    const base = parseObj(await validPinJson());
+    base['extra'] = ['a', 'b'];
+    assert.throws(() => pinFromDict(base), /pin.extra/);
+  });
+
+  it('rejects oversize extra', async () => {
+    const base = parseObj(await validPinJson());
+    const big: Record<string, string> = {};
+    for (let i = 0; i < MAX_EXTRA_ENTRIES + 1; i++) big[`k${i}`] = 'v';
+    base['extra'] = big;
+    assert.throws(() => pinFromDict(base), /maximum is/);
+  });
+});