docs(security): add SECURITY.md - #179
Conversation
GitHub shows a 'Report a vulnerability' link only when it finds this file. Researchers browsing the repo saw no intake path, even though the disclosure page and /.well-known/security.txt already exist. This points at them rather than restating the policy, so product/security.md stays the single source of truth.
WalkthroughAdded ChangesSecurity Policy
Estimated code review effort: 1 (Trivial) | ~2 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@SECURITY.md`:
- Around line 9-10: Update SECURITY.md to explicitly reference the repository’s
canonical policy source at mono/product/security.md, while retaining the
existing link to the public security.txt disclosure page.
- Around line 26-28: Update the out-of-scope list in SECURITY.md to preserve the
complete policy wording by adding exclusions for spam and issues requiring
another person’s fingerprint or face, while keeping the existing exclusions
unchanged and aligned with the linked disclosure policy.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
| That page is the current policy. Machine-readable contact details are at | ||
| [`/.well-known/security.txt`](https://peanut.me/.well-known/security.txt). |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Reference the repository’s canonical policy source.
The PR objective identifies mono/product/security.md as the single source of truth, but this file only points to the public disclosure page. Add an explicit reference to the canonical file to reduce policy drift.
Proposed fix
-That page is the current policy. Machine-readable contact details are at
+That page is the current policy. The canonical source is
+[`mono/product/security.md`](mono/product/security.md). Machine-readable contact details are at📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| That page is the current policy. Machine-readable contact details are at | |
| [`/.well-known/security.txt`](https://peanut.me/.well-known/security.txt). | |
| That page is the current policy. The canonical source is | |
| [`mono/product/security.md`](mono/product/security.md). Machine-readable contact details are at | |
| [`/.well-known/security.txt`](https://peanut.me/.well-known/security.txt). |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@SECURITY.md` around lines 9 - 10, Update SECURITY.md to explicitly reference
the repository’s canonical policy source at mono/product/security.md, while
retaining the existing link to the public security.txt disclosure page.
| - Denial of service and volumetric testing | ||
| - Social engineering | ||
| - Anything that needs physical access to another person's unlocked device |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
Preserve the complete out-of-scope wording.
The current disclosure page also excludes spam and issues requiring another person’s fingerprint or face; both exclusions are missing here. Keep this copy aligned with the linked policy. (peanut.me)
Proposed fix
-- Denial of service and volumetric testing
+- Denial of service, spam, and volumetric testing
...
-- Anything that needs physical access to another person's unlocked device
+- Anything requiring physical access to another person's unlocked device or their fingerprint or face📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - Denial of service and volumetric testing | |
| - Social engineering | |
| - Anything that needs physical access to another person's unlocked device | |
| - Denial of service, spam, and volumetric testing | |
| - Social engineering | |
| - Anything requiring physical access to another person's unlocked device or their fingerprint or face |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@SECURITY.md` around lines 26 - 28, Update the out-of-scope list in
SECURITY.md to preserve the complete policy wording by adding exclusions for
spam and issues requiring another person’s fingerprint or face, while keeping
the existing exclusions unchanged and aligned with the linked disclosure policy.
1 participant
GitHub surfaces a Report a vulnerability link only when it finds
SECURITY.md. Researchers browsing this repo saw no intake path — even though the disclosure page and/.well-known/security.txtalready exist and both return 200.That gap is concrete: of the three researchers who reported in July 2026, one mailed an unmonitored address twice, one landed in the customer support chat behind KYC tickets, and one went through a founder's Telegram. Three front doors, none of them this one.
This file points at the existing policy rather than restating it, so
mono/product/security.mdstays the single source of truth. Scope and reward wording are copied from it verbatim: