A signed contract locks, and editing it returns it to draft

11 August 2026Majed Alandajani

When I built contract signing, the question in front of me seemed obvious: how do I prevent forgery? The answer is well known: a cryptographic signature over the contract content, with a key nobody but the server holds.

Then I noticed a larger risk I had not considered.

The dangerous state

The client opens the contract and reads it, then approves. Later I open the same contract and edit a clause. No forged signature, nothing broken into. Yet the text the client agreed to has quietly become something else, and they do not know.

This is not a security hole, it is an integrity hole, and of the two it is the more dangerous because it happens in good faith: fixing a typo, updating a figure, clarifying a sentence.

The rule I applied

A contract locks once signed. Editing one that was already sent returns it to draft: the sent state is cancelled, and the contract must go out again so the client can agree to the new text.

No path exists where text somebody agreed to changes while the agreement stays in force.

Why the signature alone was not enough

A signature proves that this exact text was signed. True and important. But once the system lets the text change afterwards, the signature points at text that no longer exists, evidence of something that vanished.

The approval record is separate and immutable

Approval lives in a table that only accepts inserts; the database refuses updates and deletes on it. The contract row itself carries no approval column. Even if the contract changes later, the evidence survives that one particular version was approved at one particular time.

The trap

Changing the status on edit is only half the job. The signed version also has to stay frozen so it cannot disappear. Whoever edits a signed contract is after a new version, and the old one, signatory included, is evidence that has to remain.

The test that proved it

One test prevents the regression: sign a contract, attempt an edit, then assert that the status is back to draft and the signatory was left untouched.