Before the first public release the wallet has a written threat model, a dependency policy that CI enforces, a build that someone else can reproduce, and an external review whose findings are closed or documented. This epic runs alongside the others and gates the first tagged release.
Scope
Threat model: what the webview can and cannot do, what a compromised relay can do (nothing custodial), what a compromised node can do (lie about balances, not spend), what the updater trusts.
cargo-deny for licenses and advisories; cargo-machete for unused deps; pinned toolchain; Cargo.lock and pnpm-lock.yaml committed and frozen in CI.
Reproducible builds: the RPM from the spec and the CI artifact match bit for bit, or the difference is explained.
Secret handling audit: every type that holds a seed or key implements zeroize and redacts Debug; a test greps release logs for known test secrets.
Capability audit: each capabilities/*.json entry has a reason; no window can open arbitrary URLs.
External review: a scoped engagement or a public bounty with a published scope.
Operator-owned decisions
Who reviews, and the budget. Needed before the review child.
Bug bounty yes or no.
Definition of done
The threat model is in the repo and matches the code. CI fails on a new advisory. A release is reproduced by a second machine. The reviewer's report is linked from the release notes with every finding closed or accepted in writing.
## Goal
Before the first public release the wallet has a written threat model, a dependency policy that CI enforces, a build that someone else can reproduce, and an external review whose findings are closed or documented. This epic runs alongside the others and gates the first tagged release.
## Scope
- Threat model: what the webview can and cannot do, what a compromised relay can do (nothing custodial), what a compromised node can do (lie about balances, not spend), what the updater trusts.
- `cargo-deny` for licenses and advisories; `cargo-machete` for unused deps; pinned toolchain; `Cargo.lock` and `pnpm-lock.yaml` committed and frozen in CI.
- Reproducible builds: the RPM from the spec and the CI artifact match bit for bit, or the difference is explained.
- Secret handling audit: every type that holds a seed or key implements zeroize and redacts `Debug`; a test greps release logs for known test secrets.
- Capability audit: each `capabilities/*.json` entry has a reason; no window can open arbitrary URLs.
- External review: a scoped engagement or a public bounty with a published scope.
## Operator-owned decisions
- Who reviews, and the budget. **Needed before the review child.**
- Bug bounty yes or no.
## Definition of done
The threat model is in the repo and matches the code. CI fails on a new advisory. A release is reproduced by a second machine. The reviewer's report is linked from the release notes with every finding closed or accepted in writing.
grenade
added the epic label 2026-09-15 12:38:50 +00:00
Children: #49 (dependency policy in CI) can start as soon as #12 is green; #48 (threat model) and #50 (secret handling audit) follow #11 and #17; #51 (reproducible builds) follows #33; #52 (external review) is last and gates the first tagged release.
Children: #49 (dependency policy in CI) can start as soon as #12 is green; #48 (threat model) and #50 (secret handling audit) follow #11 and #17; #51 (reproducible builds) follows #33; #52 (external review) is last and gates the first tagged release.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Goal
Before the first public release the wallet has a written threat model, a dependency policy that CI enforces, a build that someone else can reproduce, and an external review whose findings are closed or documented. This epic runs alongside the others and gates the first tagged release.
Scope
cargo-denyfor licenses and advisories;cargo-machetefor unused deps; pinned toolchain;Cargo.lockandpnpm-lock.yamlcommitted and frozen in CI.Debug; a test greps release logs for known test secrets.capabilities/*.jsonentry has a reason; no window can open arbitrary URLs.Operator-owned decisions
Definition of done
The threat model is in the repo and matches the code. CI fails on a new advisory. A release is reproduced by a second machine. The reviewer's report is linked from the release notes with every finding closed or accepted in writing.
Children: #49 (dependency policy in CI) can start as soon as #12 is green; #48 (threat model) and #50 (secret handling audit) follow #11 and #17; #51 (reproducible builds) follows #33; #52 (external review) is last and gates the first tagged release.