# `MishkaCmsCore.Runtime.Resources.Changes.SignCode`
[🔗](https://github.com/mishka-group/mishka_cms_core/blob/v0.0.1/lib/mishka_cms_core/runtime/resources/__changes/sign_code.ex#L5)

Signs each stored snippet on the way in, so the compiler can tell what this application wrote.

`MishkaCmsCore.Runtime.PageBuilder.CodeSignature` holds the rule and is off unless a key is
configured; with no key this change is a no-op and nothing about the row changes.

## Why here rather than at each caller

There are five ways code reaches these attributes — the builder, the Gervaz form, the JSON:API, a
seed and the kit installer — and a signature applied at four of them is worth nothing, because the
fifth is the one an attacker would use. The action boundary is the only place all five pass
through.

It runs on the same four resources as `Validations.CodeChange`, and after it: there is no point
signing a write that is about to be refused.

---

*Consult [api-reference.md](api-reference.md) for complete listing*