mirror of
https://github.com/PR0M3TH3AN/bitlogin.git
synced 2026-10-27 08:31:21 +00:00
Claude
9408fef484
Preparing to open the project up beyond this repo's own use: - LICENSE: MIT, and a "license": "MIT" field on the root and all three workspace package.json files. - CONTRIBUTING.md: dev workflow, the mock-relay testing setup (most sandboxes/CI have no route to public Nostr relays, and registration needs a 2-of-N ack quorum so a single mock relay always fails), the spec-first process for anything touching wire format or crypto (docs/spec.md is canonical; speculative ideas go in their own doc, not the spec), and stricter expectations for crypto/key-handling changes. - SECURITY.md: private vulnerability disclosure via GitHub's advisory flow rather than public issues, given this handles private keys and password-derived secrets client-side; states current audit status plainly (none yet). - README: short "Contributing" section pointing at all three. Co-Authored-By: Claude <[email protected]> Claude-Session: https://claude.ai/code/session_01GWJbXXhvTx9wo59jSz57J6
40 lines
1.5 KiB
Markdown
40 lines
1.5 KiB
Markdown
# Security Policy
|
|
|
|
BitLogin handles private keys and password-derived secrets client-side —
|
|
security issues here can mean account takeover, not just a bug.
|
|
|
|
## Reporting a vulnerability
|
|
|
|
Please do not open a public GitHub issue for a suspected vulnerability.
|
|
|
|
Instead, use GitHub's private reporting flow: go to this repo's **Security**
|
|
tab → **Report a vulnerability**. This opens a private advisory visible only
|
|
to maintainers until a fix is ready, so details aren't public before users
|
|
can update.
|
|
|
|
Include, if you can:
|
|
- What's affected (crypto primitive, capsule format, key handling, a
|
|
specific derivation) and why it's exploitable.
|
|
- A minimal reproduction or proof of concept.
|
|
- Anything you already tried in `docs/spec.md`'s threat model that this
|
|
falls outside of.
|
|
|
|
## Scope
|
|
|
|
In scope: anything in `packages/core` (crypto, capsule construction/parsing,
|
|
Nostr relay I/O, account flows) and `packages/widget` (the crypto Web
|
|
Worker, the `window.nostr` provider, key custody boundaries between the
|
|
worker and the main thread).
|
|
|
|
Out of scope: the demo site's own UI/branding bugs that don't touch account
|
|
security — file those as normal public issues instead.
|
|
|
|
## Status
|
|
|
|
This project has not yet had an independent third-party security audit —
|
|
see the README's "What's implemented" section for the current verification
|
|
status (protocol-level test suite plus manual real-browser verification).
|
|
Treat that as part of the threat model when reporting: we'd rather hear
|
|
about a real issue than have it wait for a formal audit that hasn't happened
|
|
yet.
|