epic: security hardening and release readiness #10

New Issue

grenade · 2026-09-15T12:36:09Z

grenade commented

2026-09-15 12:36:09 +00:00

Goal

Before the first public release the wallet has a written threat model, a dependency policy that CI enforces, a build that someone else can reproduce, and an external review whose findings are closed or documented. This epic runs alongside the others and gates the first tagged release.

Scope

Threat model: what the webview can and cannot do, what a compromised relay can do (nothing custodial), what a compromised node can do (lie about balances, not spend), what the updater trusts.
cargo-deny for licenses and advisories; cargo-machete for unused deps; pinned toolchain; Cargo.lock and pnpm-lock.yaml committed and frozen in CI.
Reproducible builds: the RPM from the spec and the CI artifact match bit for bit, or the difference is explained.
Secret handling audit: every type that holds a seed or key implements zeroize and redacts Debug; a test greps release logs for known test secrets.
Capability audit: each capabilities/*.json entry has a reason; no window can open arbitrary URLs.
External review: a scoped engagement or a public bounty with a published scope.

Operator-owned decisions

Who reviews, and the budget. Needed before the review child.
Bug bounty yes or no.

Definition of done

The threat model is in the repo and matches the code. CI fails on a new advisory. A release is reproduced by a second machine. The reviewer's report is linked from the release notes with every finding closed or accepted in writing.

## Goal Before the first public release the wallet has a written threat model, a dependency policy that CI enforces, a build that someone else can reproduce, and an external review whose findings are closed or documented. This epic runs alongside the others and gates the first tagged release. ## Scope - Threat model: what the webview can and cannot do, what a compromised relay can do (nothing custodial), what a compromised node can do (lie about balances, not spend), what the updater trusts. - `cargo-deny` for licenses and advisories; `cargo-machete` for unused deps; pinned toolchain; `Cargo.lock` and `pnpm-lock.yaml` committed and frozen in CI. - Reproducible builds: the RPM from the spec and the CI artifact match bit for bit, or the difference is explained. - Secret handling audit: every type that holds a seed or key implements zeroize and redacts `Debug`; a test greps release logs for known test secrets. - Capability audit: each `capabilities/*.json` entry has a reason; no window can open arbitrary URLs. - External review: a scoped engagement or a public bounty with a published scope. ## Operator-owned decisions - Who reviews, and the budget. **Needed before the review child.** - Bug bounty yes or no. ## Definition of done The threat model is in the repo and matches the code. CI fails on a new advisory. A release is reproduced by a second machine. The reviewer's report is linked from the release notes with every finding closed or accepted in writing.

grenade added the epic label 2026-09-15 12:38:50 +00:00

grenade referenced this issue

2026-09-15 12:41:11 +00:00

a threat model in the repo that matches the code #48

grenade referenced this issue

2026-09-15 12:41:15 +00:00

dependency policy in ci: cargo-deny, cargo-machete, frozen lockfiles #49

grenade referenced this issue

2026-09-15 12:41:19 +00:00

secret handling audit and a test that greps for known test secrets #50

grenade referenced this issue

2026-09-15 12:41:22 +00:00

reproducible builds: the rpm from the spec matches the ci artifact #51

grenade referenced this issue

2026-09-15 12:41:26 +00:00

external review before the first tagged release #52

grenade commented

2026-09-15 12:42:48 +00:00

Children: #49 (dependency policy in CI) can start as soon as #12 is green; #48 (threat model) and #50 (secret handling audit) follow #11 and #17; #51 (reproducible builds) follows #33; #52 (external review) is last and gates the first tagged release.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: blackbeard/wallet#10