thePR0M3TH3ANandClaude Fable 5 f3c3d73c3d docs: independent security audit of the TypeScript port at e9d8908 ...

Full manual review of js/packages/core and js/packages/cli plus supply
chain. No critical or high findings. Two mediums: a same-second snapshot
tie-break that lets a restore return stale state (the flaky nostr CLI
test is this bug), and config-level password policy being ignored in TS
derivation, diverging from Python. Lows and informational notes cover
the app-32 path sharing, inert settings, token regex anchoring, and
plaintext-import fingerprint binding.

Co-Authored-By: Claude Fable 5 <[email protected]>

2026-08-18 14:48:41 -04:00

..

packages

fix(cli): vault import with --vault no longer demands a default profile

2026-08-18 14:26:16 -04:00

.gitignore

TS port first slice: fixture generator, js/ workspace, P0 derivation parity

2026-08-13 10:16:08 -04:00

package.json

TS port first slice: fixture generator, js/ workspace, P0 derivation parity

2026-08-13 10:16:08 -04:00

pnpm-lock.yaml

security: keep secrets off argv, fix packaging, add JS supply-chain CI

2026-08-14 23:13:21 -04:00

pnpm-workspace.yaml

security: keep secrets off argv, fix packaging, add JS supply-chain CI

2026-08-14 23:13:21 -04:00

SECURITY_AUDIT.md

docs: independent security audit of the TypeScript port at e9d8908

2026-08-18 14:48:41 -04:00

tsconfig.base.json

TS port first slice: fixture generator, js/ workspace, P0 derivation parity

2026-08-13 10:16:08 -04:00