# Security and limits

Iroh authenticates every connection with endpoint keys and encrypts QUIC traffic.
Applications still decide which authenticated IDs may use each ALPN and how
payloads are framed and authorized. `peer_allowlist` is a transport admission
control, not a group-membership protocol.

Private endpoint keys are opaque and inspection-redacted. File identities are
atomically created with owner-only Unix permissions. Never reuse one key for two
live endpoints. Relay tokens are separate bearer credentials and are redacted.
Tickets are not secrets, but can reveal current IP and relay addresses.

IrohBeam bounds native work with:

- endpoint pending-accept and connection limits;
- one mutable operation per stream half;
- positive receive and read-to-end limits;
- bounded send sizes and chunks;
- QUIC flow-control and datagram capacity;
- operation, startup, shutdown, and online deadlines;
- cancellation on caller or owner death.

Distribution adds exact static node/endpoint-ID admission, a bounded name/key
preface that does not atomize peer text, the normal OTP cookie handshake, one
read/write in flight, and a maximum packet-four frame. Relay tokens, endpoint
keys, and cookies are independent credentials. Distribution does not make a
relay token or cookie a membership service, and peer-map changes require a full
restart.

A send-all timeout can leave a transmitted prefix because multi-write QUIC
operations are not cancellation-atomic. Applications needing message atomicity
must add framing and protocol-level acknowledgement.

Errors and telemetry exclude private keys, tokens, payloads, peer close text,
addresses, tickets, and unstable native chains. Avoid logging raw options or
application payloads around library calls.