I fixed one security alert and five more appeared. They had been there for days – and the dashboard was green the whole time, because nothing had prompted it to look.

Signature verification proves someone holds a key. On Algorand it cannot prove that key is still the account authority – and the gap is exactly where a rotated or compromised key hides.

I needed to read a blockchain I could not read, so I built Algorandscout – an explorer API for Algorand. What I learned was mostly about the difference between a map and the territory.