edison/chanora
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore: restore product scaffold to rollback baseline

Browse Source
This commit is contained in:
Edison Jwa
2026-05-29 14:02:04 +09:00
parent 2896f14ec9
commit fe6e07353e
434 changed files with 27278 additions and 63230 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/security/secure-storage-audit-report.md
+31
View File
@@ -0,0 +1,31 @@
# Chanora Secure Storage Audit Report
**Document status:** DV meeting baseline candidate
**Date:** 2026-05-29
## 1. Scope
This report defines the secure-storage audit expected before public/store release.
## 2. Audit Matrix
| Platform | Expected backend | Current evidence state |
|---|---|---|
| Android | Android secure storage / Keystore-backed protection where implemented | Android Keystore-backed DEK deferred to v1.1 |
| iOS | Keychain | Device audit required |
| macOS | Keychain | Device audit required |
| Windows | Credential Manager | Device audit required |
| Linux | Secret Service with documented fallback behavior | Device audit required |
## 3. Required Checks
| Check | Required result |
|---|---|
| Secret persistence | Server passwords and identity secrets are not stored as unprotected plaintext |
| Fallback disclosure | Any file fallback is disclosed in release/security records |
| Diagnostic interaction | Stored secrets are registered for redaction where they can enter logs/export |
| CI behavior | CI keyring disabling is limited to headless test environments |
## 4. DV Conclusion
Secure-storage audit requirements are defined, but per-platform audit evidence is not complete. Public/store release remains blocked for strong secure-storage claims.