Security: dApp footer links to public security posture docs (#387) #915

Merged

PlasticDigits merged 3 commits from issue-387-footer-security-posture-link into main 2026-06-19 08:17:22 +00:00

Conversation 10 Commits 3 Files changed 9 +129 -2

PlasticDigits commented 2026-06-19 01:38:14 +00:00 (Migrated from gitlab.com)

Copy link

Summary

Addresses SEC-A01 (#387): the dApp footer now links to a consolidated public security posture document.

• Added docs/security-posture.md covering capped launch expectations, unaudited/limited-audit language, admin controls, known residual risks, and TVL-scaled security requirements (attack economics turn negative at low TVL; controls escalate as TVL grows).
• Wired LegalFooterNotice to SECURITY_POSTURE_DOC_URL (DOCS_GITLAB_BASE/security-posture.md) with target="_blank" and rel="noopener noreferrer".
• Unit test + cross-links in security-model.md, contracts-security-audit.md, frontend.md, docs/README.md, and skills/AGENTS_FRONTEND_TRUST_BOUNDARIES.md.

Acceptance checklist

Criterion	Verification	Result
LegalFooterNotice.tsx imports doc URL from constants.ts	grep SECURITY_POSTURE_DOC_URL frontend-dapp/src/components/legal/LegalFooterNotice.tsx	PASS
Footer renders visible anchor to security posture doc	npm run test:run -- src/components/legal/__tests__/LegalFooterNotice.test.tsx	PASS
Link opens new tab, targets security-posture.md	Unit test asserts target="_blank", rel, href suffix	PASS
Link visible on desktop/mobile footer without scrolling main content	Footer is in app-footer-shell / app-mobile-legal-strip (existing Layout); manual: load / at 375px and 1280px	PASS (structural; footer always in viewport chrome)
No existing footer tests broken	npm run test:run -- src/components/legal/__tests__/	PASS

Third-party verification

export PATH="$HOME/.nvm/versions/node/$(cat .nvmrc)/bin:$PATH"
cd frontend-dapp && npm run test:run -- src/components/legal/__tests__/LegalFooterNotice.test.tsx
make lint-frontend

Manual (with make dev):

1. Open http://127.0.0.1:5173/ on desktop and mobile viewport.
2. Confirm footer text includes Security and audit docs link.
3. Click link — opens GitLab docs/security-posture.md in a new tab.
4. Confirm doc sections: launch expectations, audit status, admin controls, residual risks, TVL-scaled requirements.

Blockers

None.

## Summary Addresses SEC-A01 ([#387](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/issues/387)): the dApp footer now links to a consolidated public security posture document. - Added [`docs/security-posture.md`](docs/security-posture.md) covering capped launch expectations, unaudited/limited-audit language, admin controls, known residual risks, and **TVL-scaled security requirements** (attack economics turn negative at low TVL; controls escalate as TVL grows). - Wired [`LegalFooterNotice`](frontend-dapp/src/components/legal/LegalFooterNotice.tsx) to `SECURITY_POSTURE_DOC_URL` (`DOCS_GITLAB_BASE/security-posture.md`) with `target="_blank"` and `rel="noopener noreferrer"`. - Unit test + cross-links in `security-model.md`, `contracts-security-audit.md`, `frontend.md`, `docs/README.md`, and [`skills/AGENTS_FRONTEND_TRUST_BOUNDARIES.md`](skills/AGENTS_FRONTEND_TRUST_BOUNDARIES.md). ## Acceptance checklist | Criterion | Verification | Result | |-----------|--------------|--------| | `LegalFooterNotice.tsx` imports doc URL from `constants.ts` | `grep SECURITY_POSTURE_DOC_URL frontend-dapp/src/components/legal/LegalFooterNotice.tsx` | PASS | | Footer renders visible anchor to security posture doc | `npm run test:run -- src/components/legal/__tests__/LegalFooterNotice.test.tsx` | PASS | | Link opens new tab, targets `security-posture.md` | Unit test asserts `target="_blank"`, `rel`, href suffix | PASS | | Link visible on desktop/mobile footer without scrolling main content | Footer is in `app-footer-shell` / `app-mobile-legal-strip` (existing Layout); manual: load `/` at 375px and 1280px | PASS (structural; footer always in viewport chrome) | | No existing footer tests broken | `npm run test:run -- src/components/legal/__tests__/` | PASS | ## Third-party verification ```bash export PATH="$HOME/.nvm/versions/node/$(cat .nvmrc)/bin:$PATH" cd frontend-dapp && npm run test:run -- src/components/legal/__tests__/LegalFooterNotice.test.tsx make lint-frontend ``` Manual (with `make dev`): 1. Open `http://127.0.0.1:5173/` on desktop and mobile viewport. 2. Confirm footer text includes **Security and audit docs** link. 3. Click link — opens GitLab `docs/security-posture.md` in a new tab. 4. Confirm doc sections: launch expectations, audit status, admin controls, residual risks, TVL-scaled requirements. ## Blockers None.

PlasticDigits commented 2026-06-19 01:38:26 +00:00 (Migrated from gitlab.com)

Copy link

changed the description

changed the description

PlasticDigits commented 2026-06-19 01:40:21 +00:00 (Migrated from gitlab.com)

Copy link

Security review — MR !915

Commit reviewed: 7b423fdea7d57c625702acbfa412d161e0a05a2c
Scope: docs/security-posture.md, LegalFooterNotice.tsx, constants.ts (SECURITY_POSTURE_DOC_URL), unit test, doc cross-links.
Outcome: FINDINGS: 0 medium+

Method

Reviewed the full MR diff and traced attacker-controlled input to sinks in the changed frontend paths. Prior MR discussion threads: none (first security pass on this MR).

Changed attack surface

Area	Assessment
Footer link (LegalFooterNotice.tsx)	href is a compile-time constant (SECURITY_POSTURE_DOC_URL); link text is static. No user/query/env input reaches the anchor.
URL constant (constants.ts)	DOCS_GITLAB_BASE and SECURITY_POSTURE_DOC_URL are hardcoded strings (same pattern as existing limit-order doc links). Not overridable via VITE_*.
target="_blank"	rel="noopener noreferrer" present; unit test asserts both — mitigates tabnabbing / window.opener abuse.
New markdown doc + README links	Documentation only; not rendered or fetched by the dApp runtime.
Dependencies / auth / secrets	No new packages, no authn/authz changes, no secret material.

Injection / SSRF / XSS / deserialization

No plausible path from attacker-controlled input to HTML injection, open redirect, SSRF, or unsafe deserialization in this diff. The link is outbound navigation to a fixed GitLab docs URL; it does not trigger server-side or in-app fetches.

Inline threads

None — no medium, high, or critical findings to anchor on specific diff lines.

Security review: no medium+ findings on this diff.

## Security review — MR !915 **Commit reviewed:** `7b423fdea7d57c625702acbfa412d161e0a05a2c` **Scope:** `docs/security-posture.md`, `LegalFooterNotice.tsx`, `constants.ts` (`SECURITY_POSTURE_DOC_URL`), unit test, doc cross-links. **Outcome:** `FINDINGS: 0` medium+ ### Method Reviewed the full MR diff and traced attacker-controlled input to sinks in the changed frontend paths. Prior MR discussion threads: none (first security pass on this MR). ### Changed attack surface | Area | Assessment | |------|------------| | Footer link (`LegalFooterNotice.tsx`) | `href` is a compile-time constant (`SECURITY_POSTURE_DOC_URL`); link text is static. No user/query/env input reaches the anchor. | | URL constant (`constants.ts`) | `DOCS_GITLAB_BASE` and `SECURITY_POSTURE_DOC_URL` are hardcoded strings (same pattern as existing limit-order doc links). Not overridable via `VITE_*`. | | `target="_blank"` | `rel="noopener noreferrer"` present; unit test asserts both — mitigates tabnabbing / `window.opener` abuse. | | New markdown doc + README links | Documentation only; not rendered or fetched by the dApp runtime. | | Dependencies / auth / secrets | No new packages, no authn/authz changes, no secret material. | ### Injection / SSRF / XSS / deserialization No plausible path from attacker-controlled input to HTML injection, open redirect, SSRF, or unsafe deserialization in this diff. The link is outbound navigation to a fixed GitLab docs URL; it does not trigger server-side or in-app fetches. ### Inline threads None — no medium, high, or critical findings to anchor on specific diff lines. **Security review: no medium+ findings on this diff.**

PlasticDigits commented 2026-06-19 01:51:12 +00:00 (Migrated from gitlab.com)

Copy link

Must have specific number ranges for different stages, so that communitt has a clear idea of low, growth, mature, and an understanding of when security costs will grow with scale. Numbers on tvl ranges for each stage eg growth is $x to $y tvl, research dex and exploits to categorize tvl based risks.

Must have specific number ranges for different stages, so that communitt has a clear idea of low, growth, mature, and an understanding of when security costs will grow with scale. Numbers on tvl ranges for each stage eg growth is $x to $y tvl, research dex and exploits to categorize tvl based risks.

PlasticDigits commented 2026-06-19 01:55:41 +00:00 (Migrated from gitlab.com)

Copy link

added 1 commit

• 6d45b115 - docs: add explicit TVL bands to security posture (#387)

Compare with previous version

added 1 commit <ul><li>6d45b115 - docs: add explicit TVL bands to security posture (#387)</li></ul> [Compare with previous version](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/197/diffs?diff_id=1860241355&start_sha=7b423fdea7d57c625702acbfa412d161e0a05a2c)

PlasticDigits commented 2026-06-19 01:55:52 +00:00 (Migrated from gitlab.com)

Copy link

Bugfix follow-up (commit 6d45b115)

Review item	Fix
Top-level note (note 3471784225): add specific TVL number ranges for bootstrap / growth / mature, grounded in DEX exploit economics	Updated docs/security-posture.md § Security requirements scale with TVL: explicit USD bands ($0–$1M bootstrap, $1M–$25M growth, $25M+ mature), indicative annual security spend per stage, exploit-cost / historical-loss context, and transition triggers (~$5M audit gate, ~$25M mature controls). Cross-links existing $100k per-pair TWAP floor.

Tests: npm run test:run -- src/components/legal/__tests__/LegalFooterNotice.test.tsx — PASS.

Thread resolution: no inline diff threads were open (glab mr note list 197 --state unresolved empty). The top-level review note is not marked resolvable in GitLab API (resolvable: false); attempted resolve returned 403.

## Bugfix follow-up (commit `6d45b115`) | Review item | Fix | |-------------|-----| | **Top-level note** (note `3471784225`): add specific TVL number ranges for bootstrap / growth / mature, grounded in DEX exploit economics | Updated [`docs/security-posture.md`](docs/security-posture.md) § *Security requirements scale with TVL*: explicit USD bands (**$0–$1M** bootstrap, **$1M–$25M** growth, **$25M+** mature), indicative annual security spend per stage, exploit-cost / historical-loss context, and transition triggers (~$5M audit gate, ~$25M mature controls). Cross-links existing [$100k per-pair TWAP floor](./twap-oracle.md). | **Tests:** `npm run test:run -- src/components/legal/__tests__/LegalFooterNotice.test.tsx` — PASS. **Thread resolution:** no inline diff threads were open (`glab mr note list 197 --state unresolved` empty). The top-level review note is not marked resolvable in GitLab API (`resolvable: false`); attempted resolve returned 403.

PlasticDigits commented 2026-06-19 01:57:29 +00:00 (Migrated from gitlab.com)

Copy link

Security review — MR !915 (re-run)

Commit reviewed: 6d45b1158c59dfa97f0b4e006f713e5b2bb68a7e
Scope: Full MR diff — docs/security-posture.md (incl. TVL-band follow-up in 6d45b115), LegalFooterNotice.tsx, constants.ts (SECURITY_POSTURE_DOC_URL), unit test, doc cross-links.
Outcome: FINDINGS: 0 medium+

Method

Re-reviewed the current MR head after the 6d45b115 doc follow-up. Traced attacker-controlled input to sinks in changed frontend paths. Prior security pass (7b423fde) had zero medium+ findings; the follow-up commit is documentation-only (explicit TVL USD bands) and does not expand runtime attack surface.

Changed attack surface

Area	Assessment
Footer link (LegalFooterNotice.tsx)	href is a compile-time constant (SECURITY_POSTURE_DOC_URL); link text is static. No user/query/env input reaches the anchor.
URL constant (constants.ts)	DOCS_GITLAB_BASE and SECURITY_POSTURE_DOC_URL are hardcoded strings (same pattern as existing limit-order / audit doc links). Not overridable via VITE_*.
target="_blank"	rel="noopener noreferrer" present; unit test asserts both — mitigates tabnabbing / window.opener abuse.
docs/security-posture.md + cross-links	Documentation only; not rendered or fetched by the dApp runtime. TVL-band table is operator guidance text, not executable policy.
Dependencies / auth / secrets	No new packages, no authn/authz changes, no secret material.

Injection / SSRF / XSS / deserialization

No plausible path from attacker-controlled input to HTML injection, open redirect, SSRF, or unsafe deserialization in this diff. The link is outbound navigation to a fixed GitLab docs URL; it does not trigger server-side or in-app fetches.

Inline threads

None — no medium, high, or critical findings to anchor on specific diff lines.

Security review: no medium+ findings on this diff.

## Security review — MR !915 (re-run) **Commit reviewed:** `6d45b1158c59dfa97f0b4e006f713e5b2bb68a7e` **Scope:** Full MR diff — `docs/security-posture.md` (incl. TVL-band follow-up in `6d45b115`), `LegalFooterNotice.tsx`, `constants.ts` (`SECURITY_POSTURE_DOC_URL`), unit test, doc cross-links. **Outcome:** `FINDINGS: 0` medium+ ### Method Re-reviewed the current MR head after the `6d45b115` doc follow-up. Traced attacker-controlled input to sinks in changed frontend paths. Prior security pass (`7b423fde`) had zero medium+ findings; the follow-up commit is documentation-only (explicit TVL USD bands) and does not expand runtime attack surface. ### Changed attack surface | Area | Assessment | |------|------------| | Footer link (`LegalFooterNotice.tsx`) | `href` is a compile-time constant (`SECURITY_POSTURE_DOC_URL`); link text is static. No user/query/env input reaches the anchor. | | URL constant (`constants.ts`) | `DOCS_GITLAB_BASE` and `SECURITY_POSTURE_DOC_URL` are hardcoded strings (same pattern as existing limit-order / audit doc links). Not overridable via `VITE_*`. | | `target="_blank"` | `rel="noopener noreferrer"` present; unit test asserts both — mitigates tabnabbing / `window.opener` abuse. | | `docs/security-posture.md` + cross-links | Documentation only; not rendered or fetched by the dApp runtime. TVL-band table is operator guidance text, not executable policy. | | Dependencies / auth / secrets | No new packages, no authn/authz changes, no secret material. | ### Injection / SSRF / XSS / deserialization No plausible path from attacker-controlled input to HTML injection, open redirect, SSRF, or unsafe deserialization in this diff. The link is outbound navigation to a fixed GitLab docs URL; it does not trigger server-side or in-app fetches. ### Inline threads None — no medium, high, or critical findings to anchor on specific diff lines. **Security review: no medium+ findings on this diff.**

PlasticDigits commented 2026-06-19 06:09:32 +00:00 (Migrated from gitlab.com)

Copy link

added 12 commits

• 6d45b115...a43de8c7 - 11 commits from branch main
• fa9e5bc8 - Merge origin/main into issue-387-footer-security-posture-link.

Compare with previous version

added 12 commits <ul><li>6d45b115...a43de8c7 - 11 commits from branch <code>main</code></li><li>fa9e5bc8 - Merge origin/main into issue-387-footer-security-posture-link.</li></ul> [Compare with previous version](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/197/diffs?diff_id=1860423898&start_sha=6d45b1158c59dfa97f0b4e006f713e5b2bb68a7e)

PlasticDigits commented 2026-06-19 06:09:35 +00:00 (Migrated from gitlab.com)

Copy link

Resolved merge conflicts with main (4 files):

• docs/README.md — kept both security model contact link (#392) and public security posture entry (#387)
• docs/security-model.md — kept launch posture intro (#387) and user incident FAQ section (#390)
• LegalFooterNotice.tsx — footer now has all three links: security posture doc, incident FAQ, and report suspicious activity
• LegalFooterNotice.test.tsx — combined unit tests for all footer links (3 tests passing)

Sanity check: npm run test:run -- src/components/legal/__tests__/LegalFooterNotice.test.tsx — PASS

Resolved merge conflicts with `main` (4 files): - `docs/README.md` — kept both security model contact link (#392) and public security posture entry (#387) - `docs/security-model.md` — kept launch posture intro (#387) and user incident FAQ section (#390) - `LegalFooterNotice.tsx` — footer now has all three links: security posture doc, incident FAQ, and report suspicious activity - `LegalFooterNotice.test.tsx` — combined unit tests for all footer links (3 tests passing) Sanity check: `npm run test:run -- src/components/legal/__tests__/LegalFooterNotice.test.tsx` — PASS

PlasticDigits commented 2026-06-19 06:11:14 +00:00 (Migrated from gitlab.com)

Copy link

Security review — MR !915

Commit reviewed: fa9e5bc83ef766a551c5b256f72b3c00a17aabf6
Scope: Full MR diff (9 files) — docs/security-posture.md, LegalFooterNotice.tsx, constants.ts (SECURITY_POSTURE_DOC_URL), unit test, doc/skill cross-links.
Outcome: FINDINGS: 0 medium+

Method

Re-reviewed current MR head after merge of origin/main (fa9e5bc8). Inspected the full diff and traced attacker-controlled input to sinks in changed frontend paths. Prior security passes on 7b423fde and 6d45b115 reported zero medium+ findings; this pass covers the updated head including the main merge resolution in the footer component.

Changed attack surface

Area	Assessment
Footer link (LegalFooterNotice.tsx)	href is a compile-time constant (SECURITY_POSTURE_DOC_URL); link text is static JSX. No user, query, routing, or env input reaches the anchor.
URL constant (constants.ts)	DOCS_GITLAB_BASE and SECURITY_POSTURE_DOC_URL are hardcoded strings (same pattern as existing limit-order and incident FAQ doc links). Not overridable via VITE_*.
target="_blank"	rel="noopener noreferrer" present; unit test asserts both — mitigates tabnabbing / window.opener abuse.
docs/security-posture.md + cross-links	Documentation only; not rendered or fetched by the dApp runtime. TVL-band table is operator guidance text, not executable policy.
Dependencies / auth / secrets	No new packages, no authn/authz changes, no secret material, no logging changes.

Injection / SSRF / XSS / deserialization

No plausible path from attacker-controlled input to HTML injection, open redirect, SSRF, or unsafe deserialization in this diff. The link is outbound navigation to a fixed GitLab docs URL on the project default branch; it does not trigger server-side or in-app fetches.

Inline threads

None — no medium, high, or critical findings to anchor on specific diff lines.

Security review: no medium+ findings on this diff.

## Security review — MR !915 **Commit reviewed:** `fa9e5bc83ef766a551c5b256f72b3c00a17aabf6` **Scope:** Full MR diff (9 files) — `docs/security-posture.md`, `LegalFooterNotice.tsx`, `constants.ts` (`SECURITY_POSTURE_DOC_URL`), unit test, doc/skill cross-links. **Outcome:** `FINDINGS: 0` medium+ ### Method Re-reviewed current MR head after merge of `origin/main` (`fa9e5bc8`). Inspected the full diff and traced attacker-controlled input to sinks in changed frontend paths. Prior security passes on `7b423fde` and `6d45b115` reported zero medium+ findings; this pass covers the updated head including the main merge resolution in the footer component. ### Changed attack surface | Area | Assessment | |------|------------| | Footer link (`LegalFooterNotice.tsx`) | `href` is a compile-time constant (`SECURITY_POSTURE_DOC_URL`); link text is static JSX. No user, query, routing, or env input reaches the anchor. | | URL constant (`constants.ts`) | `DOCS_GITLAB_BASE` and `SECURITY_POSTURE_DOC_URL` are hardcoded strings (same pattern as existing limit-order and incident FAQ doc links). Not overridable via `VITE_*`. | | `target="_blank"` | `rel="noopener noreferrer"` present; unit test asserts both — mitigates tabnabbing / `window.opener` abuse. | | `docs/security-posture.md` + cross-links | Documentation only; not rendered or fetched by the dApp runtime. TVL-band table is operator guidance text, not executable policy. | | Dependencies / auth / secrets | No new packages, no authn/authz changes, no secret material, no logging changes. | ### Injection / SSRF / XSS / deserialization No plausible path from attacker-controlled input to HTML injection, open redirect, SSRF, or unsafe deserialization in this diff. The link is outbound navigation to a fixed GitLab docs URL on the project default branch; it does not trigger server-side or in-app fetches. ### Inline threads None — no medium, high, or critical findings to anchor on specific diff lines. **Security review: no medium+ findings on this diff.**

PlasticDigits (Migrated from gitlab.com) merged commit 13900236ec into main 2026-06-19 08:17:22 +00:00

PlasticDigits commented 2026-06-19 08:17:23 +00:00 (Migrated from gitlab.com)

Copy link

mentioned in commit 13900236ec

mentioned in commit 13900236eccaf4af1daf55b8fd8ebfce98e43f7d

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

agent:fix_bugfix

  

agent:fix_conflicts

  

agent:fix_security

  

agent:gap_analysis

  

agent:implement

  

agent:implement

Queue implement gate

  

agent:implement

Queue implement gate

  

agent:open_issues

  

agent:ready

  

agent:research

  

agent:security_audit

  

agent:verify

  

architecture

Architecture

  

backend

API and services

  

blocker:hybrid

Blocks hybrid launch

  

blocker:launch

Blocks launch

  

blocker:limit-orders

Blocks limits launch

  

blocker:v2

Blocks v2

  

block:log_only

  

block:security

  

bug

  

ci

  

contracts

Smart contracts

  

correctness

  

deploy

  

dev

  

devops

  

docs

  

documentation

  

duplicate

  

e2e

  

enhancement

  

epic

Epic

  

feature

  

frontend

  

functional-completion

Functional

  

gas

  

good first issue

  

governance

  

help wanted

  

high-risk

  

hooks

  

hybrid

Hybrid swaps

  

indexer

Indexer

  

infra

CI/CD

  

infrastructure

  

integrators

  

invalid

  

launch-blocker

  

limit-orders

Limit orders

  

localnet

  

localterra

  

low priority

  

missing-implementation

Implementation

  

needs-design

Design decision required

  

ops

  

performance

  

priority

high

  

priority

medium

  

product

  

qa

  

QA

  

question

  

ready

Definition of Ready

  

ready

Definition of Ready

  

research

  

scripts

  

security

Security

  

security-hardening

Security hardening

  

smartcontracts

  

tech-debt

  

testing

Testing

  

ux

  

UX

  

v2

Pool-only swaps

  

verification

  

wontfix

No labels

agent:fix_bugfix

agent:fix_conflicts

agent:fix_security

agent:gap_analysis

agent:implement

agent:implement

agent:implement

agent:open_issues

agent:ready

agent:research

agent:security_audit

agent:verify

architecture

backend

blocker:hybrid

blocker:launch

blocker:limit-orders

blocker:v2

block:log_only

block:security

bug

ci

contracts

correctness

deploy

dev

devops

docs

documentation

duplicate

e2e

enhancement

epic

feature

frontend

functional-completion

gas

good first issue

governance

help wanted

high-risk

hooks

hybrid

indexer

infra

infrastructure

integrators

invalid

launch-blocker

limit-orders

localnet

localterra

low priority

missing-implementation

needs-design

ops

performance

priority

high

priority

medium

product

qa

QA

question

ready

ready

research

scripts

security

security-hardening

smartcontracts

tech-debt

testing

ux

UX

v2

verification

wontfix

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

code/cl8y-dex-terraclassic!915

No description provided.