code/cl8y-dex-terraclassic

Fork 0

Security: no security contact or escalation path for users reporting suspicious trades or UI states [SEC-A07] #392

New issue

Closed

opened 2026-06-18 15:37:09 +00:00 by totdking · 10 comments

totdking commented

2026-06-18 15:37:09 +00:00

(Migrated from gitlab.com)

No description provided.

totdking commented

2026-06-18 15:37:44 +00:00

(Migrated from gitlab.com)

Checklist Item

SEC-A07: Create a concise security contact/escalation path for users reporting suspicious trades or UI states. Verify: visible docs issue/MR with contact path and expected response window.

Summary

There is no security contact, responsible disclosure policy, or user-accessible escalation path anywhere in the repo or dApp. A user who sees a suspicious trade, unexpected balance, or broken UI state has no documented way to report it and no expectation of when or how they will receive a response.

What Was Checked

README.md -- no security contact
Root directory -- no SECURITY.md file
.gitlab/issue_templates/ -- no public-facing security report template
docs/security-model.md -- threat model and mitigations only, no contact or disclosure section
docs/templates/incident-dex-indexer.md -- internal operator template, not user-accessible
frontend-dapp/src/components/legal/LegalFooterNotice.tsx -- NFA copy only, no contact link
frontend-dapp/src/components/common/navItems.ts -- no Help, About, or Contact page in navigation
frontend-dapp/src/components/common/Layout.tsx -- footer shows branding and legal notice only
docs/reviews/20260409T030009Z/ISSUE_TEMPLATES/security.md -- internal review template, not a public GitLab issue template

Expected (per checklist)

A concise security contact and escalation path must exist that is visible to users. It must include: how to report a suspicious trade or UI state, who to contact (email, Discord, GitLab issue, or equivalent), and an expected response window. It must be accessible from the dApp or from a linked docs page.

Actual

None of the above exists. No email, Discord, Telegram, or named contact is published anywhere in the repo or dApp. No responsible disclosure policy exists. No response window is documented. No public GitLab issue template for security reports exists. The dApp navigation has no Help or Contact page. The footer has no link to any reporting channel.

Evidence

Root directory: no SECURITY.md file
frontend-dapp/src/components/legal/LegalFooterNotice.tsx lines 3-9: plain text only, no link or contact
frontend-dapp/src/components/common/navItems.ts: routes are Swap, Pool, Limits, Trade, Portfolio, Charts, Trader, Protocol, Tiers, Create Pair -- no Help or Contact
docs/security-model.md: 197 lines covering threat model, no user contact section
CODEOWNERS: only @PlasticDigits listed, no security alias or dedicated contact role

Suggested Fix

Create a SECURITY.md at the repository root containing:

A named contact channel (GitLab issue with security label, Discord handle, or email)
A brief responsible disclosure guideline ("do not publish exploit details publicly before contacting us")
An expected initial response window (e.g. 48-72 hours)

Add a public GitLab issue template at .gitlab/issue_templates/security_report.md so users have a structured way to submit reports.

Link the security contact from the dApp -- either add a "Report an issue" link to LegalFooterNotice.tsx pointing to the GitLab security report template, or add a Help/Contact entry to the nav pointing to SECURITY.md.

Verification Checklist

Steps to confirm the fix is complete and the checklist item can be marked done.

SECURITY.md exists at repository root with contact channel and response window
A public GitLab issue template for security reports exists in .gitlab/issue_templates/
The security contact is reachable from the dApp (footer link, nav entry, or equivalent)
Response window is explicitly stated (e.g. 48-72 hours initial acknowledgement)
Responsible disclosure guidance is included (no public disclosure before contact)

Labels

security, pre-launch

Cc: @PlasticDigits

### Checklist Item SEC-A07: Create a concise security contact/escalation path for users reporting suspicious trades or UI states. Verify: visible docs issue/MR with contact path and expected response window. --- ### Summary There is no security contact, responsible disclosure policy, or user-accessible escalation path anywhere in the repo or dApp. A user who sees a suspicious trade, unexpected balance, or broken UI state has no documented way to report it and no expectation of when or how they will receive a response. --- ### What Was Checked - `README.md` -- no security contact - Root directory -- no `SECURITY.md` file - `.gitlab/issue_templates/` -- no public-facing security report template - `docs/security-model.md` -- threat model and mitigations only, no contact or disclosure section - `docs/templates/incident-dex-indexer.md` -- internal operator template, not user-accessible - `frontend-dapp/src/components/legal/LegalFooterNotice.tsx` -- NFA copy only, no contact link - `frontend-dapp/src/components/common/navItems.ts` -- no Help, About, or Contact page in navigation - `frontend-dapp/src/components/common/Layout.tsx` -- footer shows branding and legal notice only - `docs/reviews/20260409T030009Z/ISSUE_TEMPLATES/security.md` -- internal review template, not a public GitLab issue template --- ### Expected (per checklist) A concise security contact and escalation path must exist that is visible to users. It must include: how to report a suspicious trade or UI state, who to contact (email, Discord, GitLab issue, or equivalent), and an expected response window. It must be accessible from the dApp or from a linked docs page. --- ### Actual None of the above exists. No email, Discord, Telegram, or named contact is published anywhere in the repo or dApp. No responsible disclosure policy exists. No response window is documented. No public GitLab issue template for security reports exists. The dApp navigation has no Help or Contact page. The footer has no link to any reporting channel. --- ### Evidence - Root directory: no `SECURITY.md` file - `frontend-dapp/src/components/legal/LegalFooterNotice.tsx` lines 3-9: plain text only, no link or contact - `frontend-dapp/src/components/common/navItems.ts`: routes are Swap, Pool, Limits, Trade, Portfolio, Charts, Trader, Protocol, Tiers, Create Pair -- no Help or Contact - `docs/security-model.md`: 197 lines covering threat model, no user contact section - `CODEOWNERS`: only `@PlasticDigits` listed, no security alias or dedicated contact role --- ### Suggested Fix Create a `SECURITY.md` at the repository root containing: - A named contact channel (GitLab issue with `security` label, Discord handle, or email) - A brief responsible disclosure guideline ("do not publish exploit details publicly before contacting us") - An expected initial response window (e.g. 48-72 hours) Add a public GitLab issue template at `.gitlab/issue_templates/security_report.md` so users have a structured way to submit reports. Link the security contact from the dApp -- either add a "Report an issue" link to `LegalFooterNotice.tsx` pointing to the GitLab security report template, or add a Help/Contact entry to the nav pointing to `SECURITY.md`. --- ### Verification Checklist Steps to confirm the fix is complete and the checklist item can be marked done. - [ ] `SECURITY.md` exists at repository root with contact channel and response window - [ ] A public GitLab issue template for security reports exists in `.gitlab/issue_templates/` - [ ] The security contact is reachable from the dApp (footer link, nav entry, or equivalent) - [ ] Response window is explicitly stated (e.g. 48-72 hours initial acknowledgement) - [ ] Responsible disclosure guidance is included (no public disclosure before contact) --- ### Labels `security`, `pre-launch` Cc: @PlasticDigits

totdking commented

2026-06-18 15:38:05 +00:00

(Migrated from gitlab.com)

mentioned in issue #381

PlasticDigits commented

2026-06-19 01:35:49 +00:00

(Migrated from gitlab.com)

Can use contact@ceramicliberty.com for now.

PlasticDigits commented

2026-06-19 01:40:50 +00:00

(Migrated from gitlab.com)

mentioned in commit 8bc9972aa5

mentioned in commit 8bc9972aa51886ff340f784fd96e97cf9fc7ec0a

PlasticDigits commented

2026-06-19 01:41:09 +00:00

(Migrated from gitlab.com)

mentioned in merge request !918

PlasticDigits commented

2026-06-19 01:53:40 +00:00

(Migrated from gitlab.com)

mentioned in commit fcc9eaf601

mentioned in commit fcc9eaf6014cc54768ec99161c0b8ff2049299d5

PlasticDigits commented

2026-06-19 01:57:22 +00:00

(Migrated from gitlab.com)

mentioned in merge request !919

PlasticDigits commented

2026-06-19 06:09:35 +00:00

(Migrated from gitlab.com)

mentioned in merge request !915

PlasticDigits commented

2026-06-19 08:22:47 +00:00

(Migrated from gitlab.com)

Verification — SEC-A07 (#392)

Result: PASS (all acceptance criteria met on main; no repo changes required)

Checklist

Criterion	Result	How verified
`SECURITY.md` at repo root with contact channel and response window	PASS	`test -f SECURITY.md`; content includes `contact@ceramicliberty.com`, GitLab `security_report` template URL, 48–72 hour acknowledgement
Public GitLab issue template in `.gitlab/issue_templates/`	PASS	`test -f .gitlab/issue_templates/security_report.md`; frontmatter has `security` label and structured report fields
Security contact reachable from the dApp	PASS	`LegalFooterNotice.tsx` footer link Report suspicious activity → `SECURITY_REPORT_ISSUE_URL`; rendered in desktop footer and mobile legal strip (`Layout.tsx`); unit test asserts href/target/rel
Response window explicitly stated	PASS	`grep '48–72 hours' SECURITY.md`; mirrored in `docs/qa-onboarding.md` § Security Escalation
Responsible disclosure guidance	PASS	`SECURITY.md` § Responsible disclosure — do not publish exploit details before contact

Commands run

test -f SECURITY.md
test -f .gitlab/issue_templates/security_report.md
grep -q '48–72 hours' SECURITY.md
grep -q 'contact@ceramicliberty.com' SECURITY.md
grep -q 'Do not' SECURITY.md
cd frontend-dapp && npm run test:unit -- src/components/legal/__tests__/LegalFooterNotice.test.tsx

Unit tests: 3/3 passed (including GitLab security-template link).

Manual

Live make dev footer click-through was not run (no frontend-dapp/.env.local on this VM). Footer link behavior is covered by LegalFooterNotice.test.tsx and component wiring in Layout.tsx. GitLab new-issue URL returns expected auth redirect for anonymous curl (template path is valid).

Cross-links reviewed

README.md → SECURITY.md
docs/README.md, docs/security-model.md § User security contact
docs/qa-onboarding.md § Security Escalation
skills/AGENTS_SECURITY_CONTACT.md playbook with invariants and verification commands

Closing as complete.

## Verification — SEC-A07 (#392) **Result: PASS** (all acceptance criteria met on `main`; no repo changes required) ### Checklist | Criterion | Result | How verified | |-----------|--------|--------------| | `SECURITY.md` at repo root with contact channel and response window | **PASS** | `test -f SECURITY.md`; content includes `contact@ceramicliberty.com`, GitLab `security_report` template URL, **48–72 hour** acknowledgement | | Public GitLab issue template in `.gitlab/issue_templates/` | **PASS** | `test -f .gitlab/issue_templates/security_report.md`; frontmatter has `security` label and structured report fields | | Security contact reachable from the dApp | **PASS** | `LegalFooterNotice.tsx` footer link **Report suspicious activity** → `SECURITY_REPORT_ISSUE_URL`; rendered in desktop footer and mobile legal strip (`Layout.tsx`); unit test asserts href/target/rel | | Response window explicitly stated | **PASS** | `grep '48–72 hours' SECURITY.md`; mirrored in `docs/qa-onboarding.md` § Security Escalation | | Responsible disclosure guidance | **PASS** | `SECURITY.md` § Responsible disclosure — do not publish exploit details before contact | ### Commands run ```bash test -f SECURITY.md test -f .gitlab/issue_templates/security_report.md grep -q '48–72 hours' SECURITY.md grep -q 'contact@ceramicliberty.com' SECURITY.md grep -q 'Do not' SECURITY.md cd frontend-dapp && npm run test:unit -- src/components/legal/__tests__/LegalFooterNotice.test.tsx ``` Unit tests: **3/3 passed** (including GitLab security-template link). ### Manual Live `make dev` footer click-through was not run (no `frontend-dapp/.env.local` on this VM). Footer link behavior is covered by `LegalFooterNotice.test.tsx` and component wiring in `Layout.tsx`. GitLab new-issue URL returns expected auth redirect for anonymous `curl` (template path is valid). ### Cross-links reviewed - `README.md` → `SECURITY.md` - `docs/README.md`, `docs/security-model.md` § User security contact - `docs/qa-onboarding.md` § Security Escalation - `skills/AGENTS_SECURITY_CONTACT.md` playbook with invariants and verification commands Closing as complete.

PlasticDigits (Migrated from gitlab.com) closed this issue

2026-06-19 08:22:48 +00:00

PlasticDigits commented

2026-08-26 04:13:33 +00:00

(Migrated from gitlab.com)

mentioned in issue #663