Add security section to README

Added a security note regarding the use of the blake3 Rust crate.
This commit is contained in:
2026-04-18 13:51:42 +02:00
committed by GitHub
parent b93c309d5b
commit c35f70d00e
+5 -1
View File
@@ -56,8 +56,12 @@ Tested on **Ryzen 7 5800X**, Node.js v24.
| 1 MB | 51 MB/s | 1,671 MB/s | 1,893 MB/s |
| 10 MB | 51 MB/s | 1,572 MB/s | 1,812 MB/s |
## Security
The underlying `blake3` Rust crate targets algorithmic constant time. However, the JavaScript boundary (via napi-rs or WASM) introduces non-determinism from the V8 runtime that is outside our control. For absolute security, use the `blake3` Rust crate directly in a Rust program.
## See also
- [@noble/hashes](https://github.com/paulmillr/noble-hashes) | pure JS implementation
- [awasm-noble](https://github.com/paulmillr/awasm-noble) | auditable WASM implementation
- [blake3-napi](https://github.com/UneBaguette/blake3-napi) | native Node.js addon, faster for large inputs
- [blake3-napi](https://github.com/UneBaguette/blake3-napi) | native Node.js addon, faster for large inputs