jwinterm
143f00701b
- minimal Axum server exposing GET /health - OpenAPI contract generated from handlers (gen_openapi -> openapi.json), drift-gated in CI so the spec can never silently diverge from the code - CI: secret-scan + gitleaks, openapi drift gate, fmt/clippy/build/test/doc-test, cargo-deny - Cargo.lock tracked for reproducible builds; publish=false; pinned toolchain - README, SECURITY.md, deny.toml, .env.example
1.1 KiB
Security Policy
Reporting a vulnerability
Please report security issues privately. Do not open public issues or pull requests for vulnerabilities.
- Email: security@smirk.cash
- Encrypt sensitive reports with our PGP key (fingerprint published at
https://smirk.cash/.well-known/security.txt).
Include enough detail to reproduce: affected endpoint/component, version or commit, and a proof of concept where possible. We aim to acknowledge reports within 72 hours and to keep you updated as we triage and fix.
Scope
This repository (smirk-backend-core) — the self-hostable backend. Issues in
node software it talks to (Bitcoin/Litecoin/Monero/Wownero/Grin daemons,
light-wallet servers, Electrum) should be reported to those projects, though
we welcome reports about how this backend uses them.
Operating securely
smirk-backend-core is non-custodial: it never stores seeds or spend keys.
The admin surface authenticates with seed-derived public keys ("Sign in with
Smirk") and stores only public keys. Default deployment posture binds admin and
setup to loopback / a Tor hidden service. See docs/ for the hardening guide.