mirror of
https://github.com/Such-Software/smirk-backend-core.git
synced 2026-10-17 15:31:38 +02:00
jwinterm
143f00701b
- minimal Axum server exposing GET /health - OpenAPI contract generated from handlers (gen_openapi -> openapi.json), drift-gated in CI so the spec can never silently diverge from the code - CI: secret-scan + gitleaks, openapi drift gate, fmt/clippy/build/test/doc-test, cargo-deny - Cargo.lock tracked for reproducible builds; publish=false; pinned toolchain - README, SECURITY.md, deny.toml, .env.example
29 lines
1.1 KiB
Markdown
29 lines
1.1 KiB
Markdown
# Security Policy
|
|
|
|
## Reporting a vulnerability
|
|
|
|
Please report security issues **privately**. Do not open public issues or pull
|
|
requests for vulnerabilities.
|
|
|
|
- Email: security@smirk.cash
|
|
- Encrypt sensitive reports with our PGP key (fingerprint published at
|
|
`https://smirk.cash/.well-known/security.txt`).
|
|
|
|
Include enough detail to reproduce: affected endpoint/component, version or
|
|
commit, and a proof of concept where possible. We aim to acknowledge reports
|
|
within 72 hours and to keep you updated as we triage and fix.
|
|
|
|
## Scope
|
|
|
|
This repository (`smirk-backend-core`) — the self-hostable backend. Issues in
|
|
node software it talks to (Bitcoin/Litecoin/Monero/Wownero/Grin daemons,
|
|
light-wallet servers, Electrum) should be reported to those projects, though
|
|
we welcome reports about how this backend uses them.
|
|
|
|
## Operating securely
|
|
|
|
`smirk-backend-core` is non-custodial: it never stores seeds or spend keys.
|
|
The admin surface authenticates with seed-derived public keys ("Sign in with
|
|
Smirk") and stores only public keys. Default deployment posture binds admin and
|
|
setup to loopback / a Tor hidden service. See `docs/` for the hardening guide.
|