Skip to content

SECURITY.md

Latest commit

 

History

History
30 lines (23 loc) · 1.37 KB

SECURITY.md

File metadata and controls

30 lines (23 loc) · 1.37 KB
Raw

Security Policy

This project aligns with the security-reporting practices of the LF Decentralized Trust ecosystem that the wider Hiero project follows.

Reporting a vulnerability

Please do not open a public issue for anything you believe to be a security vulnerability. Instead, use GitHub private vulnerability reporting ("Report a vulnerability" under the repository's Security tab).

Include what you can: affected file/function, a proof-of-concept input, and the impact you foresee. You will get an acknowledgement within a few days.

Scope notes for reporters

Areas of this tool that are security-relevant by design and welcome scrutiny:

  • Delivery targets — webhook URLs and delivery configuration come from the operator's config; anything that lets a watched account's on-chain data redirect, forge, or inject into a delivery would be a serious bug.
  • Rendered receipts — receipts embed attacker-writable memo text; the rendering defenses live upstream in hiero-receipts, but a bypass observable through this tool is reportable here too.
  • Config parsing — notify.config.json and CLI flags are operator input, not attacker input, but confusion between the two is in scope.