EdisonJwa
f1bc9a6c85
Imports the v0.9.2 documentation baseline and the bootstrap files required by docs/governance/repository-bootstrap-plan.md v0.1.0 §3, minus the justfile (added in the next commit). This commit establishes the git history for the project. All previous work lived only as filesystem state with no version control.
52 lines
1.4 KiB
Markdown
52 lines
1.4 KiB
Markdown
# Security Policy
|
|
|
|
## Supported status
|
|
|
|
Chanora is not production-ready yet. Security reports are still welcome during early development.
|
|
|
|
## Reporting a vulnerability
|
|
|
|
Do not open public issues for sensitive security reports.
|
|
|
|
Until a private security channel is established, report security concerns directly to the project maintainer through the agreed private contact channel.
|
|
|
|
## Sensitive areas
|
|
|
|
Important security areas include:
|
|
|
|
- identity private keys and identity material;
|
|
- server passwords;
|
|
- platform secure storage;
|
|
- local database contents;
|
|
- diagnostic logs and export bundles;
|
|
- protocol input from compatible servers;
|
|
- Flutter/Rust bridge DTO validation;
|
|
- audio permission behavior;
|
|
- dependency and supply-chain integrity;
|
|
- OSS license and attribution compliance.
|
|
|
|
## Security gates before public release
|
|
|
|
Before any public or store release, the following documents must be completed and reviewed:
|
|
|
|
```text
|
|
docs/security/threat-model.md
|
|
docs/security/secure-storage-audit-report.md
|
|
docs/security/diagnostic-redaction-audit-report.md
|
|
docs/security/dependency-and-supply-chain-report.md
|
|
docs/privacy/privacy-policy.md
|
|
docs/legal/trademark-and-attribution-review.md
|
|
```
|
|
|
|
## Secret handling rule
|
|
|
|
Secrets must not be stored in plaintext local storage or written to logs.
|
|
|
|
Secrets include:
|
|
|
|
- server passwords;
|
|
- identity private keys;
|
|
- authentication tokens if later added;
|
|
- secure-storage keys;
|
|
- signing credentials.
|